#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <time.h>
#include <errno.h>
#include <sys/wait.h>
#include <sys/ioctl.h> 
#include <locale.h>
#include <libintl.h>
#include <dirent.h>
#include <langinfo.h>
#include <term.h>
#include <ncurses.h>
#include <assert.h>
#include <sys/types.h>
#include <pwd.h>

/*
 * pstree 命令是以树形结构显示程序和进程之间的关系
 * 
 * 编译时更新 gettext 版本
 *  sudo apt update && sudo apt upgrade gettext
 *
 * https://gitlab.com/psmisc/psmisc.git 
 *	3098e64
 *
 *  https://ftp.gnu.org/pub/gnu/ncurses/        (ncurses lib)
 */

/*
char * getenv(const char* name);
用来取得参数name环境变量的内容
*/

/*
int snprintf(char* dest_str,size_t size,const char* format,…)
*/

#if 0
struct option
{
  const char *name;
  /* has_arg can't be an enum because some compilers complain about
     type mismatches in all the code that assumes it is an int.  */
  int has_arg;
  int *flag;
  int val;
};
#endif

struct shape
{
    char *first;
    char *second;
    char *three;
    char *four;
    char *five;
    char *six;
};

struct shape s_one = {
    "  ",
    "\033(0\017tq\033(B",
    "\033(0\017x\033(B ",
    "\033(0\017mq\033(B",
    "\033(0\017qqq\033(B",
    "\033(0\017qwq\033(B"
};

struct shape s_two = {
    .first  = "  ",
    .second = "├─",
    .three  = "│ ",
    .four   = "└─",
    .five   = "───",
    .six    = "─┬─"
};

struct shape s_three = {
    "  ",
    "|-",
    "| ",
    "`-",
    "---",
    "-+-"
};

struct shape *shape_pointer = &s_three;

/* Names for the values of the 'has_arg' field of 'struct option'.  */
# define no_argument            0
# define required_argument      1
# define optional_argument      2

static struct option const long_options[] =
{
	{"arguments", no_argument, NULL, 'a'},
	{"ascii", no_argument, NULL, 'A'},
	{"compact-not", no_argument, NULL, 'c'},
	{"color", 1, NULL, 'C'},
	{"vt100", no_argument, NULL, 'G'},
	{"highlight-all", no_argument, NULL, 'h'},
	{"highlight-pid", 1, NULL, 'H'},
	{"long", no_argument, NULL, 'l'},
	{"numeric-sort", no_argument, NULL, 'n'},
	{"ns-sort", 1, NULL, 'N'},
	{"show-pids", no_argument, NULL, 'p'},
	{"show-pgids", no_argument, NULL, 'g'},
	{"show-parents", no_argument, NULL, 's'},
	{"ns-changes", no_argument, NULL, 'S'},
	{"thread-names", no_argument, NULL, 't'},
	{"hide-threads", no_argument, NULL, 'T'},
	{"uid-changes", no_argument, NULL, 'u'},
	{"unicode", no_argument, NULL, 'U'},
	{"version", no_argument, NULL, 'V'},
	{"security-context", no_argument, NULL, 'Z'},
	{NULL, 0, NULL, 0}
};

char *gvar_8ba0[] = {
    [0] = "cgroup",
    [1] = "ipc",
    [2] = "mnt",
    [3] = "net",
    [4] = "pid",
    [5] = "user",
    [6] = "uts",
    [7] = "time"
};

#define COMM_LEN 64

typedef struct _proc {
    char comm[COMM_LEN + 2 + 1]; /* add another 2 for thread brackets */    // 72           // ==> 0x00
    char **argv;    // 8         /* only used : argv[0] is 1st arg; undef if argc < 1 */    // ==> 0x48
    int argc;       // 4         /* with -a   : number of arguments, -1 if swapped    */    // ==> 0x50
    pid_t pid;      // 4                // ==> 0x54
    pid_t pgid;     // 4                // ==> 0x58
    pid_t uid;      // 4                // ==> 0x5c
    ino_t ns[8];    // 64               // ==> 0x60
    char flags;     // 8                // ==> 0xA0
    double age;     // 8                // ==> 0xA8
    struct _child *children;    // 8    // ==> 0xB0
    struct _proc *parent;       // 8    // ==> 0xB8
    struct _proc *next;         // 8    // ==> 0xC0
} PROC;     

typedef struct _child {
    PROC *child;                // ==> 0x00
    struct _child *next;        // ==> 0x08
} CHILD;

struct ns_entry {
    ino_t number;               // ==> 0x00
    CHILD *children;            // ==> 0x08
    struct ns_entry *next;      // ==> 0x10
};

struct age_to_color {
    unsigned int age_seconds;
    char *color;
};

struct age_to_color gvar_g2e0[] = {
    { 60, "\033[32m"},
    {3600,   "\033[33m"},
    {0,	    "\033[31m"}
    };

int gvar_9468 = 0;
int gvar_6b20 = 0;
int gvar_6982 = 0;
int gvar_92c8 = 1;
int gvar_92c4 = 113;
int gvar_92cc = 1;
int gvar_9440 = 0;
int gvar_9444 = 0;
int gvar_9448 = 0;
int gvar_9450 = 0;
int gvar_9454 = 0;
int gvar_9458 = 0;
int gvar_945c = 0;
char *gvar_61cb = "/proc";
double gvar_6c70 = 0.0;
PROC *gvar_9488 = NULL;
int gvar_9438 = 0;
int *gvar_9478 = 0;
int *gvar_9470 = 0;
int gvar_9480 = 0;
int gvar_9430 = 0;
int gvar_9400 = 0;
int gvar_9460 = 0;
int gvar_9464 = 0;
int gvar_944c = 0;
int gvar_92c0 = 0;
int gvar_943c = 0;
int gvar_9434 = 0;


void fun_3bd0_help();
void fun_5460();
int get_ws_col();
int fun_4f20(PROC *a, PROC * b);
static PROC *fun_4fd0(const char *comm, pid_t pid, uid_t uid);
int fun_5150(const char *comm, pid_t pid, pid_t ppid, pid_t pgid, uid_t uid,
         const char *args, int size, char isthread, double process_age_sec);
void trim_tree_by_parent(PROC *a);
static void fun_3db0(PROC *r, int id, struct ns_entry **root);
void fun_4e70(PROC * current, uid_t uid);
void fun_3f90(const char str);
void fun_4340(PROC * current, int level, int rep, int leaf, int last,
          uid_t prev_uid, int closing);
int fun_4110(char *str);
void fun_4210(void);
static void out_string(const char *str);
static PROC *find_proc(pid_t pid);


static void out_string(const char *str)
{
    while (*str)
        fun_3f90(*str++);
}

/* 360c */
void trim_tree_by_parent(PROC * current)
{
    if (!current)
        return;

    PROC * parent = current->parent;
    CHILD *walk, *next;

    if (!parent)
        return;
    
    walk = parent->children;
    while (walk != NULL) {
        next = walk->next;
        free(walk);
        walk = next;
    }

    parent->children = NULL;
    fun_4f20(parent, current);
    trim_tree_by_parent(parent);
}

static PROC *find_proc(pid_t pid)
{
    PROC *walk;

    for (walk = gvar_9488; walk; walk = walk->next) {
        if (walk->pid == pid)
            return walk;
    }
    return NULL;
}

int main(int argc, char **argv)
{
    /*2780:	f3 0f 1e fa          	endbr64 
    2784:	41 57                	push   %r15
    2786:	41 56                	push   %r14
    2788:	41 55                	push   %r13
    278a:	41 54                	push   %r12
    278c:	55                   	push   %rbp
    278d:	53                   	push   %rbx		
    278e:	4c 8d 9c 24 00 c0 ff 	lea    -0x4000(%rsp),%r11	// r11 = rsp-0x4000, (r11) = 0, rsp地址不变
    2795:	ff */
    
	/*2796:	48 81 ec 00 10 00 00 	sub    $0x1000,%rsp		// rsp = rsp-0x1000，(rsp)=1, rsp地址变化, 0x1000/8=512
    279d:	48 83 0c 24 00       	orq    $0x0,(%rsp)		// (rsp) = 1
    27a2:	4c 39 dc             	cmp    %r11,%rsp		// rsp > r11
    27a5:	75 ef                	jne    2796 <__sprintf_chk@plt+0x26>	// 循环三次, until r11 = rsp 

    27a7:	48 81 ec 08 08 00 00 	sub    $0x808,%rsp		// 0x808/8=257
    27ae:	b9 54 00 00 00       	mov    $0x54,%ecx		// ecx = 0x54 = 84 --> 84个8字节

    27b3:	64 48 8b 04 25 28 00 	mov    %fs:0x28,%rax	
    27ba:	00 00 
    27bc:	48 89 84 24 f8 47 00 	mov    %rax,0x47f8(%rsp)
    27c3:	00 
    27c4:	31 c0                	xor    %eax,%eax	*/		// 堆栈检查溢出

    /*27c6:	4c 8d ac 24 40 01 00 	lea    0x140(%rsp),%r13*/		// r13=var_option	0x140/8=40
		struct option var_option[21]={0};
        pid_t pid, highlight = 0;
        int pid_set = 0;
        struct ns_entry *nsroot = NULL;
        struct passwd *pw = NULL;
        int nsid = -1;

    /*27cd:	00 
    27ce:	89 fd                	mov    %edi,%ebp	// argc:0x1
    27d0:	49 89 f4             	mov    %rsi,%r12	// r12=argv:"/home/wangzhijun/work/ac-code/command/pstree/reverse-64/intel-r4/pstree"
    27d3:	4c 89 ef             	mov    %r13,%rdi	// rdi=var_option
    27d6:	48 8d 35 43 68 00 00 	lea    0x6843(%crip),%rsi        # 9020 <_IO_stdin_used@@Base+0x3020> // rsi = 0x55555555d020
    27dd:	48 c7 84 24 88 00 00 	movq   $0x0,0x88(%rsp)	// (rsp+0x88)=*nsroot 0x7fffffff9a18: 0x00
    27e4:	00 00 00 00 00 
    27e9:	f3 48 a5             	rep movsq %ds:(%rsi),%es:(%rdi)*/
	memcpy(var_option, long_options, sizeof(long_options));
	
	int i;
	for (i = 0; i < 21; i++) {
		//printf("%s\n", long_options[i].name);
		//printf("%s %d %d %d\n", var_option[i].name, var_option[i].has_arg, (int)(long)var_option[i].flag, var_option[i].val);
	}

    int ret = -1;
	
    #if 0
    /*27ec:	48 8d 3d 58 39 00 00 	lea    0x3958(%rip),%rdi        # 614b <_IO_stdin_used@@Base+0x14b> // rdi="COLUMNS"
    27f3:	e8 e8 fb ff ff       	callq  23e0 <getenv@plt>*/	// getenv(rdi)
    // char *ptr_strtol;
    // struct winsize p_0xa8;
        /*struct winsize
        {
            unsigned short ws_row; // 窗口字符行数。
            unsigned short ws_col; // 窗口字符列数。
            unsigned short ws_xpixel; // 窗口宽度，象素值。
            unsigned short ws_ypixel; // 窗口高度，象素值。
        };*/
    
	char *p_getenv = getenv("COLUMNS");

    /*27f8:	48 85 c0             	test   %rax,%rax			// rax="113"
    27fb:	74 09                	je     2806 <__sprintf_chk@plt+0x96>	// no
    27fd:	80 38 00             	cmpb   $0x0,(%rax)			// 0-0x31, so zf=0
    2800:	0f 85 1e 07 00 00    	jne    2f24 <__sprintf_chk@plt+0x7b4>*/	// if zf=0 than jump
    
	if ((p_getenv != NULL) && (*p_getenv != 0)) {
			// goto 2f24 --> 283a
            col = strtol(p_getenv, &ptr_strtol, 0);
            printf("col = %d\n", col);

            if ( (!*ptr_strtol) && (col > 0) && (col < 0x7ffffffd))

	} else {

    /*2806:	48 8d 94 24 a8 00 00 	lea    0xa8(%rsp),%rdx  // rdx=(rsp+0xa8)=struct winsize p_0xa8
    280d:	00 
    280e:	be 13 54 00 00       	mov    $0x5413,%esi
    2813:	bf 01 00 00 00       	mov    $0x1,%edi
    2818:	31 c0                	xor    %eax,%eax
    281a:	e8 51 fd ff ff       	callq  2570 <ioctl@plt>
    281f:	41 89 c0             	mov    %eax,%r8d*/          // r8d=ret，把返回值存起来, 此处有可能是一个函数调用的返回。
    
        // include/uapi/asm-generic/ioctls.h:38:#define TIOCGWINSZ 0x5413
        ret = ioctl(1, 0x5413, &p_0xa8);
        printf("ret = %d, 0x%x\n", ret, p_0xa8.ws_row);    
        col = 0x84;
    
    /*2822:	b8 84 00 00 00       	mov    $0x84,%eax   // 0x84=132
    2827:	45 85 c0             	test   %r8d,%r8d    // r8d=ret
    282a:	78 0e                	js     283a <__sprintf_chk@plt+0xca>    SF = 1 负数, jump
    282c:	0f b7 8c 24 aa 00 00 	movzwl 0xaa(%rsp),%ecx  // (rsp+0xaa)=p_0xa8.ws_col，通过查看内存值可以判断结构的成员及大小
    2833:	00 
    2834:	66 85 c9             	test   %cx,%cx          // cx=cx&0xff
    2837:	0f 45 c1             	cmovne %ecx,%eax */     // cmovne 不等传送
        if (ret >= 0) {
            if (p_0xa8.ws_col != 0) {
                col = p_0xa8.ws_col;
            }
        }
    }
    #endif

    gvar_92c4 = get_ws_col();

    /*283a:	48 8d 35 2b 3a 00 00 	lea    0x3a2b(%rip),%rsi        # 626c <_IO_stdin_used@@Base+0x26c> // ""
    2841:	bf 06 00 00 00       	mov    $0x6,%edi
    2846:	89 05 78 6a 00 00    	mov    %eax,0x6a78(%rip)        # 92c4 <_IO_stdin_used@@Base+0x32c4> // 0x55555555684c+0x6a78=0x55555555d2c4=113
    284c:	e8 4f fe ff ff       	callq  26a0 <setlocale@plt>*/
    
	char *p_3a2b = (char *)"";
	char *p_ret;
	if (ret == 0) {
		p_ret = setlocale(__LC_ALL, p_3a2b);
		printf("ret = %s\n", p_ret);
	}
    
    /*2851:	48 8d 35 fb 38 00 00 	lea    0x38fb(%rip),%rsi        # 6153 <_IO_stdin_used@@Base+0x153> // "/usr/share/locale"
    2858:	48 8d 3d 06 39 00 00 	lea    0x3906(%rip),%rdi        # 6165 <_IO_stdin_used@@Base+0x165> // "psmisc"
    285f:	e8 8c fc ff ff       	callq  24f0 <bindtextdomain@plt>*/
    
    p_ret = bindtextdomain("psmisc", "/usr/share/locale");
	printf("ret = %s\n", p_ret);
	
    /*2864:	48 8d 3d fa 38 00 00 	lea    0x38fa(%rip),%rdi        # 6165 <_IO_stdin_used@@Base+0x165> // "psmisc"
    286b:	e8 40 fc ff ff       	callq  24b0 <textdomain@plt>*/
    
    textdomain("psmisc");
    
    /*2870:	48 8b 35 69 6b 00 00 	mov    0x6b69(%rip),%rsi        # 93e0 <__progname@@GLIBC_2.2.5>    // "pstree"
    2877:	b9 0b 00 00 00       	mov    $0xb,%ecx                // ecx=11
    287c:	48 8d 3d e9 38 00 00 	lea    0x38e9(%rip),%rdi        # 616c <_IO_stdin_used@@Base+0x16c> // "pstree.x11"
    2883:	f3 a6                	repz cmpsb %es:(%rdi),%ds:(%rsi)
    2885:	0f 97 c0             	seta   %al          // al=0
    2888:	1c 00                	sbb    $0x0,%al     // al=0xff
    288a:	84 c0                	test   %al,%al      // al=0xff&0xff=0xff, --> zf=0
    288c:	75 0a                	jne    2898 <__sprintf_chk@plt+0x128>   // zf=0, jump
    288e:	c7 05 b8 6b 00 00 01 	movl   $0x1,0x6bb8(%rip)        # 9450 <stderr@@GLIBC_2.2.5+0x30>
    2895:	00 00 00 */
        if (strncmp("pstree.x11", "pstree", 0xb) != 0)  
            gvar_9450 = 1;

    /*2898:	bf 01 00 00 00       	mov    $0x1,%edi
    289d:	e8 ce fb ff ff       	callq  2470 <isatty@plt>*/
		// isatty(1);

    /*28a2:	85 c0                	test   %eax,%eax    // eax=1, --> zf=0
    28a4:	74 21                	je     28c7 <__sprintf_chk@plt+0x157>   // zf=1
    28a6:	bf 0e 00 00 00       	mov    $0xe,%edi    // edi=0xe
    28ab:	e8 a0 fd ff ff       	callq  2650 <nl_langinfo@plt>*/

	char * p_nl_ret = nl_langinfo(14);  // p_nl_ret="utf-8"

    /*28b0:	48 8d 35 c0 38 00 00 	lea    0x38c0(%rip),%rsi        # 6177 <_IO_stdin_used@@Base+0x177>		"UTF-8"
    28b7:	48 89 c7             	mov    %rax,%rdi				// rdi="UTF-8"
    28ba:	e8 11 fd ff ff       	callq  25d0 <strcmp@plt>
    28bf:	85 c0                	test   %eax,%eax		// eax=0, zf=1
    28c1:	0f 84 43 03 00 00    	je     2c0a <__sprintf_chk@plt+0x49a>*/	// zf=1, jump

	char * p_38c0 = "UTF-8";
	if (isatty(1) && (strcmp(p_nl_ret, p_38c0) == 0)) {
        // je 2c0a
        shape_pointer = &s_two;
    }
    else {
    /*28c7:	bf 01 00 00 00       	mov    $0x1,%edi
    28cc:	e8 9f fb ff ff       	callq  2470 <isatty@plt>
    28d1:	85 c0                	test   %eax,%eax
    28d3:	0f 85 84 06 00 00    	jne    2f5d <__sprintf_chk@plt+0x7ed> */
        if (isatty(1) != 0 && (getenv("TERM") != 0) && (setupterm(0, 1, 0) == 0) && (tigetstr("acsc") != 0)) {
            // jne 2f5d
            shape_pointer = &s_one;
        }
        else {
    /*28d9:	48 8d 05 c0 6a 00 00 	lea    0x6ac0(%rip),%rax        # 93a0 <age_to_color@@Base+0xc0>
    28e0:	48 89 05 29 6a 00 00 	mov    %rax,0x6a29(%rip)        # 9310 <age_to_color@@Base+0x30>*/  // 9310=shape_pointer
           shape_pointer = &s_one;
        }
    }

	// jump
    /*28e7:	c7 44 24 1c 07 00 00 	movl   $0x7,0x1c(%rsp)			// (rsp+0x1c)=0x7fffffff9a8c:0x00000007
    28ee:	00 
    28ef:	48 8d 1d 82 42 00 00 	lea    0x4282(%rip),%rbx        # 6b78 <_IO_stdin_used@@Base+0xb78> // rbx=0x55555555ab78: 0xffffbe9dffffbf2c。 x/52xw $rbx, 查看case跳转地址，从A到z。
    28f6:	c7 44 24 04 00 00 00 	movl   $0x0,0x4(%rsp)           // (rsp+0x4)=highlight
    28fd:	00 
    28fe:	66 90                	xchg   %ax,%ax                  // ax=ax
    2900:	45 31 c0             	xor    %r8d,%r8d                // r8d=0
    2903:	4c 89 e9             	mov    %r13,%rcx				// rcx=var_option
    2906:	48 8d 15 8f 38 00 00 	lea    0x388f(%rip),%rdx        # 619c <_IO_stdin_used@@Base+0x19c> // rdx="aAcC:GhH:nN:pglsStTuUVZ"
    290d:	4c 89 e6             	mov    %r12,%rsi				// r12=argv
    2910:	89 ef                	mov    %ebp,%edi	            // edi=ebp=argc:0x1
    2912:	e8 19 fc ff ff       	callq  2530 <getopt_long@plt>
    2917:	83 f8 ff             	cmp    $0xffffffff,%eax */

    char ch = -1;
    char *arg = "aAcC:GhH:nN:pglsStTuUVZ";
    while ((ch = getopt_long(argc, argv, arg, var_option, NULL)) != -1) {
		switch (ch) {

    /*291a:	0f 84 fd 02 00 00    	je     2c1d <__sprintf_chk@plt+0x4ad>
    2920:	83 e8 41             	sub    $0x41,%eax       // eax=eax-0x41, 转换成字符
    2923:	83 f8 34             	cmp    $0x34,%eax       // eax ?= 0x34 (52), 大小写字母共52个
    2926:	0f 87 e9 00 00 00    	ja     2a15 <__sprintf_chk@plt+0x2a5> */   // 大于52即不是有效字符跳转

    /*292c:	48 63 04 83          	movslq (%rbx,%rax,4),%rax   // rbx=0x55555555ab78, (rbx)=0xffffbe9dffffbf2c, rax*4=0x20*4=0x80, rax=(0x55555555ab78+0x80)=0x55555555abf8:0xffffbe9dffffbdd4, rax=0xffffffffffffbdd4
    2930:	48 01 d8             	add    %rbx,%rax            // rax=0xffffffffffffbdd4+0x55555555ab78=0x55555555694c
    2933:	3e ff e0             	notrack jmpq *%rax */         // 0x55555555694c: 0x000100006b1205c7  --> x/i $rax => 0x55555555694c:      movl   $0x1,0x6b12(%rip)

    #if 0
    0xffffffffffffbf2c A     0xffffffffffffbf06 C
    0xffffffffffffbf3f G     0xffffffffffffbea2 H
    0xffffffffffffbe60 N     
    0xffffffffffffbe51 S     0xffffffffffffbe42 T
    0xffffffffffffbe2f U     0xffffffffffffbdf9 V
    0xffffffffffffbde0 Z
    0xffffffffffffbdd4 a     0xffffffffffffbdc8 c
    0xffffffffffffbff0 g     0xffffffffffffbf9d h
    0xffffffffffffbf8e l
    0xffffffffffffbf7f n     0xffffffffffffbdbe p
    0xffffffffffffbf70 s     0xffffffffffffbf61 t
    0xffffffffffffbf52 u
    #endif

            case 'p':
    /*2936:	c7 05 20 6b 00 00 01 	movl   $0x1,0x6b20(%rip)        # 9460 <stderr@@GLIBC_2.2.5+0x40>   // gvar_6b20
    293d:	00 00 00 */
            gvar_6b20 = 1;

            case 'c':
    /*2940:	c7 05 82 69 00 00 00 	movl   $0x0,0x6982(%rip)        # 92cc <_IO_stdin_used@@Base+0x32cc>    // gvar_92cc
    2947:	00 00 00 
    294a:	eb b4                	jmp    2900 <__sprintf_chk@plt+0x190> */                   
            gvar_6982 = 0;
            break;

        case 'a':
    /*294c:	c7 05 12 6b 00 00 01 	movl   $0x1,0x6b12(%rip)        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468
    2953:	00 00 00 
    2956:	eb a8                	jmp    2900 <__sprintf_chk@plt+0x190> */
            gvar_9468 = 1;
            break;
            
            case 'Z':
    /*2958:	e8 c3 fa ff ff       	callq  2420 <is_selinux_enabled@plt>
    295d:	85 c0                	test   %eax,%eax
    295f:	0f 8e 94 09 00 00    	jle    32f9 <__sprintf_chk@plt+0xb89>
    2965:	c7 05 d1 6a 00 00 01 	movl   $0x1,0x6ad1(%rip)        # 9440 <stderr@@GLIBC_2.2.5+0x20>   // gvar_9440
    296c:	00 00 00 
    296f:	eb 8f                	jmp    2900 <__sprintf_chk@plt+0x190>*/
            gvar_9440= 1;
            break;

            case 'V':
    /*2971:	31 c0                	xor    %eax,%eax
    2973:	45 31 ff             	xor    %r15d,%r15d
    2976:	e8 e5 2a 00 00       	callq  5460 <__sprintf_chk@plt+0x2cf0> */
            fun_5460();

    /* 跳转到此为程序结束 */
    /*297b:	48 8b 84 24 f8 47 00 	mov    0x47f8(%rsp),%rax
    2982:	00 
    2983:	64 48 33 04 25 28 00 	xor    %fs:0x28,%rax
    298a:	00 00 
    298c:	0f 85 3f 11 00 00    	jne    3ad1 <__sprintf_chk@plt+0x1361>
    2992:	48 81 c4 08 48 00 00 	add    $0x4808,%rsp
    2999:	44 89 f8             	mov    %r15d,%eax
    299c:	5b                   	pop    %rbx
    299d:	5d                   	pop    %rbp
    299e:	41 5c                	pop    %r12
    29a0:	41 5d                	pop    %r13						// r13=var_option
    29a2:	41 5e                	pop    %r14
    29a4:	41 5f                	pop    %r15
    29a6:	c3                   	retq   */

            case 'U':
    /*29a7:	48 8d 05 b2 69 00 00 	lea    0x69b2(%rip),%rax        # 9360 <age_to_color@@Base+0x80>
    29ae:	48 89 05 5b 69 00 00 	mov    %rax,0x695b(%rip)        # 9310 <age_to_color@@Base+0x30>    // 9310=shape_pointer
    29b5:	e9 46 ff ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            shape_pointer = &s_two;
            break;
            
            case 'T':
    /*29ba:	c7 05 80 6a 00 00 01 	movl   $0x1,0x6a80(%rip)        # 9444 <stderr@@GLIBC_2.2.5+0x24>
    29c1:	00 00 00 
    29c4:	e9 37 ff ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_9444 = 1;
            break;

            case 'S':
    /*29c9:	c7 05 79 6a 00 00 01 	movl   $0x1,0x6a79(%rip)        # 944c <stderr@@GLIBC_2.2.5+0x2c>   // gvar_944c
    29d0:	00 00 00 
    29d3:	e9 28 ff ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_944c = 1;
            break;
            
            case 'N':
    /*29d8:	4c 8b 3d 21 6a 00 00 	mov    0x6a21(%rip),%r15        # 9400 <optarg@@GLIBC_2.2.5> // 0x6a21+%rip=0x55555555d400 <optarg>:0x00007fffffffe31f:"cgroup", 接收到的命令行参数
    29df:	45 31 f6             	xor    %r14d,%r14d */           // r14=0
            
    /*29e2:	48 8d 3d 2e 37 00 00 	lea    0x372e(%rip),%rdi        # 6117 <_IO_stdin_used@@Base+0x117> // rdi=0x55555555a117:"cgroup"
    29e9:	eb 10                	jmp    29fb <__sprintf_chk@plt+0x28b>
    29eb:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)*/
            for (i = 0; i < 7; i++) {    
    /*29f0:	48 8d 05 a9 61 00 00 	lea    0x61a9(%rip),%rax        # 8ba0 <_IO_stdin_used@@Base+0x2ba0>    // 8ba0:6117:cgroup        // gvar_8ba0
    29f7:	4a 8b 3c f0          	mov    (%rax,%r14,8),%rdi       // rdi=8ba0+i*8      
    29fb:	4c 89 fe             	mov    %r15,%rsi            // rsi=r15=optarg=0x00007fffffffe31f
    29fe:	e8 cd fb ff ff       	callq  25d0 <strcmp@plt>            
    2a03:	85 c0                	test   %eax,%eax
    2a05:	0f 84 7d 01 00 00    	je     2b88 <__sprintf_chk@plt+0x418>*/
                if (strcmp(gvar_8ba0[i], optarg) == 0) {
                    // je 2b88
                }
    /*2a0b:	49 83 c6 01          	add    $0x1,%r14            // r14+=1
    2a0f:	49 83 fe 07          	cmp    $0x7,%r14            // r14 < 7
    2a13:	75 db                	jne    29f0 <__sprintf_chk@plt+0x280> */
            }

            default:
    /*2a15:	e8 b6 11 00 00       	callq  3bd0 <__sprintf_chk@plt+0x1460>*/
                fun_3bd0_help();
                break;
            
            case 'H':
    /*2a1a:	44 8b 7c 24 04       	mov    0x4(%rsp),%r15d      // r15d=(rsp+0x4)=highlight
    2a1f:	45 85 ff             	test   %r15d,%r15d
    2a22:	75 f1                	jne    2a15 <__sprintf_chk@plt+0x2a5>
    2a24:	48 8d 3d 52 37 00 00 	lea    0x3752(%rip),%rdi        # 617d <_IO_stdin_used@@Base+0x17d> // "TERM"
    2a2b:	e8 b0 f9 ff ff       	callq  23e0 <getenv@plt>
    2a30:	48 85 c0             	test   %rax,%rax
    2a33:	0f 84 6d 0f 00 00    	je     39a6 <__sprintf_chk@plt+0x1236>
    2a39:	48 8d 3d 3d 37 00 00 	lea    0x373d(%rip),%rdi        # 617d <_IO_stdin_used@@Base+0x17d> // "TERM"
    2a40:	e8 9b f9 ff ff       	callq  23e0 <getenv@plt>
    2a45:	48 8d bc 24 e0 03 00 	lea    0x3e0(%rsp),%rdi
    2a4c:	00 
    2a4d:	48 89 c6             	mov    %rax,%rsi
    2a50:	e8 db fc ff ff       	callq  2730 <tgetent@plt>
    2a55:	85 c0                	test   %eax,%eax
    2a57:	0f 8e 5a 0f 00 00    	jle    39b7 <__sprintf_chk@plt+0x1247>
    2a5d:	48 8b 3d 9c 69 00 00 	mov    0x699c(%rip),%rdi        # 9400 <optarg@@GLIBC_2.2.5>
    2a64:	ba 0a 00 00 00       	mov    $0xa,%edx
    2a69:	31 f6                	xor    %esi,%esi
    2a6b:	e8 90 fb ff ff       	callq  2600 <strtol@plt>
    2a70:	89 44 24 04          	mov    %eax,0x4(%rsp)       // (rsp+0x4)=highlight
    2a74:	85 c0                	test   %eax,%eax
    2a76:	0f 85 84 fe ff ff    	jne    2900 <__sprintf_chk@plt+0x190>
            break;

    2a7c:	eb 97                	jmp    2a15 <__sprintf_chk@plt+0x2a5>*/

            case 'C':
    /*2a7e:	48 8b 35 7b 69 00 00 	mov    0x697b(%rip),%rsi        # 9400 <optarg@@GLIBC_2.2.5>        // gvar_9400
    2a85:	48 8d 3d fb 36 00 00 	lea    0x36fb(%rip),%rdi        # 6187 <_IO_stdin_used@@Base+0x187> // "age"
    2a8c:	e8 9f f9 ff ff       	callq  2430 <strcasecmp@plt>
    2a91:	85 c0                	test   %eax,%eax
    2a93:	75 80                	jne    2a15 <__sprintf_chk@plt+0x2a5>
    2a95:	c7 05 91 69 00 00 01 	movl   $0x1,0x6991(%rip)        # 9430 <stderr@@GLIBC_2.2.5+0x10>   // gvar_9430
    2a9c:	00 00 00 
    2a9f:	e9 5c fe ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190> */
            break;

            case 'A':
    /*2aa4:	48 8d 05 f5 68 00 00 	lea    0x68f5(%rip),%rax        # 93a0 <age_to_color@@Base+0xc0>
    2aab:	48 89 05 5e 68 00 00 	mov    %rax,0x685e(%rip)        # 9310 <age_to_color@@Base+0x30>    // 9310=shape_pointer
    2ab2:	e9 49 fe ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            shape_pointer = &s_one;
            break;
            
            case 'G':
    /*2ab7:	48 8d 05 62 68 00 00 	lea    0x6862(%rip),%rax        # 9320 <age_to_color@@Base+0x40>
    2abe:	48 89 05 4b 68 00 00 	mov    %rax,0x684b(%rip)        # 9310 <age_to_color@@Base+0x30>    // 9310=shape_pointer
    2ac5:	e9 36 fe ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            shape_pointer = &s_three;
            break;

            case 'u':
    /*2aca:	c7 05 90 69 00 00 01 	movl   $0x1,0x6990(%rip)        # 9464 <stderr@@GLIBC_2.2.5+0x44>   // gvar_9464
    2ad1:	00 00 00 
    2ad4:	e9 27 fe ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_9464 = 1;
            break;

            case 't':
    /*2ad9:	c7 05 65 69 00 00 01 	movl   $0x1,0x6965(%rip)        # 9448 <stderr@@GLIBC_2.2.5+0x28>   // gvar_9448
    2ae0:	00 00 00 
    2ae3:	e9 18 fe ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_9448 = 1;
            break;

            case 's':
    /*2ae8:	c7 05 66 69 00 00 01 	movl   $0x1,0x6966(%rip)        # 9458 <stderr@@GLIBC_2.2.5+0x38>   gvar_9458
    2aef:	00 00 00 
    2af2:	e9 09 fe ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_9458 = 1;
            break;

            case 'n':
    /*2af7:	c7 05 53 69 00 00 01 	movl   $0x1,0x6953(%rip)        # 9454 <stderr@@GLIBC_2.2.5+0x34>
    2afe:	00 00 00 
    2b01:	e9 fa fd ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_9454 = 1;
            break;
            
            case 'l':
    /*2b06:	c7 05 b8 67 00 00 00 	movl   $0x0,0x67b8(%rip)        # 92c8 <_IO_stdin_used@@Base+0x32c8>    // gvar_92c8
    2b0d:	00 00 00 
    2b10:	e9 eb fd ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_92c8 = 0;
            break;

            case 'h':
    /*2b15:	8b 44 24 04          	mov    0x4(%rsp),%eax           // (rsp+0x4)=highlight
    2b19:	85 c0                	test   %eax,%eax
    2b1b:	0f 85 f4 fe ff ff    	jne    2a15 <__sprintf_chk@plt+0x2a5>
    2b21:	48 8d 3d 55 36 00 00 	lea    0x3655(%rip),%rdi        # 617d <_IO_stdin_used@@Base+0x17d> // "TERM"
    2b28:	e8 b3 f8 ff ff       	callq  23e0 <getenv@plt>
    2b2d:	48 85 c0             	test   %rax,%rax
    2b30:	0f 84 ca fd ff ff    	je     2900 <__sprintf_chk@plt+0x190>*/

    /*2b36:	48 8d 3d 40 36 00 00 	lea    0x3640(%rip),%rdi        # 617d <_IO_stdin_used@@Base+0x17d> // "TERM"
    2b3d:	e8 9e f8 ff ff       	callq  23e0 <getenv@plt>
    2b42:	48 8d bc 24 e0 03 00 	lea    0x3e0(%rsp),%rdi
    2b49:	00 
    2b4a:	48 89 c6             	mov    %rax,%rsi
    2b4d:	e8 de fb ff ff       	callq  2730 <tgetent@plt>
    2b52:	85 c0                	test   %eax,%eax
    2b54:	0f 8e a6 fd ff ff    	jle    2900 <__sprintf_chk@plt+0x190>
            

    2b5a:	e8 41 f9 ff ff       	callq  24a0 <getpid@plt>
    2b5f:	89 44 24 04          	mov    %eax,0x4(%rsp)           // (rsp+0x4)=highlight
    2b63:	e9 98 fd ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            break;
            
            case 'g':
    /*2b68:	c7 05 ea 68 00 00 01 	movl   $0x1,0x68ea(%rip)        # 945c <stderr@@GLIBC_2.2.5+0x3c>       // gvar_945c
    2b6f:	00 00 00 
    2b72:	c7 05 50 67 00 00 00 	movl   $0x0,0x6750(%rip)        # 92cc <_IO_stdin_used@@Base+0x32cc>    // gvar_92cc
    2b79:	00 00 00 
    2b7c:	e9 7f fd ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
            gvar_945c = 1;
            gvar_92cc = 0;
            break;

    /*2b81:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/      // nopl

    /* case 'N' 有可能跳转到此 */
    /*2b88:	44 89 74 24 1c       	mov    %r14d,0x1c(%rsp)
    2b8d:	48 8d 05 0c 60 00 00 	lea    0x600c(%rip),%rax        # 8ba0 <_IO_stdin_used@@Base+0x2ba0>    // gvar_8ba0
    2b94:	45 89 f6             	mov    %r14d,%r14d
    2b97:	4e 8b 3c f0          	mov    (%rax,%r14,8),%r15
    2b9b:	4c 8d b4 24 f0 27 00 	lea    0x27f0(%rsp),%r14
    2ba2:	00 
    2ba3:	e8 f8 f8 ff ff       	callq  24a0 <getpid@plt>
    2ba8:	48 83 ec 08          	sub    $0x8,%rsp
    2bac:	4c 89 f7             	mov    %r14,%rdi
    2baf:	4c 8d 05 68 35 00 00 	lea    0x3568(%rip),%r8        # 611e <_IO_stdin_used@@Base+0x11e>  // "/proc/%i/ns/%s"
    2bb6:	41 57                	push   %r15
    2bb8:	41 89 c1             	mov    %eax,%r9d
    2bbb:	b9 32 00 00 00       	mov    $0x32,%ecx
    2bc0:	ba 01 00 00 00       	mov    $0x1,%edx
    2bc5:	be 32 00 00 00       	mov    $0x32,%esi
    2bca:	31 c0                	xor    %eax,%eax
    2bcc:	e8 1f f8 ff ff       	callq  23f0 <__snprintf_chk@plt>
    2bd1:	48 8d 94 24 c0 00 00 	lea    0xc0(%rsp),%rdx
    2bd8:	00 
    2bd9:	4c 89 f6             	mov    %r14,%rsi
    2bdc:	bf 01 00 00 00       	mov    $0x1,%edi
    2be1:	e8 3a fa ff ff       	callq  2620 <__xstat@plt>
    2be6:	41 5b                	pop    %r11
    2be8:	41 5e                	pop    %r14
    2bea:	85 c0                	test   %eax,%eax
    2bec:	0f 84 0e fd ff ff    	je     2900 <__sprintf_chk@plt+0x190>   // continue
    2bf2:	4c 8b 25 07 68 00 00 	mov    0x6807(%rip),%r12        # 9400 <optarg@@GLIBC_2.2.5>    // gvar_9400
    2bf9:	ba 05 00 00 00       	mov    $0x5,%edx
    2bfe:	48 8d 35 8b 3e 00 00 	lea    0x3e8b(%rip),%rsi        # 6a90 <_IO_stdin_used@@Base+0xa90> // "procfs file for %s namespace not available\n"
    2c05:	e9 0c 04 00 00       	jmpq   3016 <__sprintf_chk@plt+0x8a6> */
        }   /* switch ended for getopt_long */
    }   /* while ((ch = getopt_long)) */

    #if 0
    0x55555555a2b2:	"  "                        // lea    0x674f(%rip),%rax     # rax=0x55555555d360, 0x55555555d360:0x000055555555a2b2
    
    0x55555555a2b5:	"\033(0\017tq\033(B"
    0x55555555a2bf:	"\033(0\017x\033(B "
    0x55555555a2c9:	"\033(0\017mq\033(B"
    0x55555555a2d3:	"\033(0\017qqq\033(B"
    0x55555555a2de:	"\033(0\017qwq\033(B"

    0x55555555a2e9:	"├─"
    0x55555555a2f0:	"│ "
    0x55555555a2f5:	"└─"
    0x55555555a2fc:	"───"
    0x55555555a306:	"─┬─"

    0x55555555a310:	"|-"
    0x55555555a313:	"| "
    0x55555555a316:	"`-"
    0x55555555a319:	"---"
    0x55555555a31d:	"-+-"

    0x55555555a321:	"ipc"
    0x55555555a325:	"mnt"
    0x55555555a329:	"net"
    0x55555555a32d:	"user"
    
    /*2c0a:	48 8d 05 4f 67 00 00 	lea    0x674f(%rip),%rax        # 9360 <age_to_color@@Base+0x80>	// rax=0x55555555d360, 0x2c11+0x674f=0x9360, 地址值
    2c11:	48 89 05 f8 66 00 00 	mov    %rax,0x66f8(%rip)        # 9310 <age_to_color@@Base+0x30>	// (rip)+0x66f8=0x55555555d310:0x55555555d360, 2c18+0x66f8=0x9310, 把地址值赋给它，故它为指针类型
    2c18:	e9 ca fc ff ff       	jmpq   28e7 <__sprintf_chk@plt+0x177>*/
        shape_pointer = &s_two;
    #endif

    /* 没有getopt_long时跳转到此 */
    /*2c1d:	8d 5d ff             	lea    -0x1(%rbp),%ebx          // rbp=argc, ebx = argc-1 = 0
    2c20:	3b 1d d2 67 00 00    	cmp    0x67d2(%rip),%ebx        # 93f8 <optind@@GLIBC_2.2.5>    // 93f8 = optind
    2c26:	0f 84 8b 03 00 00    	je     2fb7 <__sprintf_chk@plt+0x847>*/
        if (optind == argc - 1) {
            // jump 2fb7        
        }
    /*2c2c:	c7 44 24 38 00 00 00 	movl   $0x0,0x38(%rsp)  // (rsp+0x38)=pid_set=0
    2c33:	00 
    2c34:	c7 44 24 3c 01 00 00 	movl   $0x1,0x3c(%rsp)  // (rsp+0x3c)=pid=1
    2c3b:	00 
    2c3c:	48 c7 44 24 28 00 00 	movq   $0x0,0x28(%rsp)  // (rsp+0x28)=0
    2c43:	00 00 
    2c45:	39 2d ad 67 00 00    	cmp    %ebp,0x67ad(%rip)        # 93f8 <optind@@GLIBC_2.2.5>    // 93f8 = optind
    2c4b:	0f 85 c4 fd ff ff    	jne    2a15 <__sprintf_chk@plt+0x2a5>*/
        if (optind != argc) {
            // jne 2a15
            fun_3bd0_help();
        }

    /*2c51:	48 c7 84 24 a0 00 00 	movq   $0x0,0xa0(%rsp)
    2c58:	00 00 00 00 00 
    2c5d:	48 c7 84 24 a8 00 00 	movq   $0x0,0xa8(%rsp)
    2c64:	00 00 00 00 00 
    2c69:	e8 b2 f7 ff ff       	callq  2420 <is_selinux_enabled@plt>
    2c6e:	83 3d 53 66 00 00 00 	cmpl   $0x0,0x6653(%rip)        # 92c8 <_IO_stdin_used@@Base+0x32c8>    // gvar_92c8=1
    2c75:	48 c7 44 24 20 01 20 	movq   $0x2001,0x20(%rsp)       // (rsp+0x20)=0x2001
    2c7c:	00 00 
    2c7e:	89 44 24 18          	mov    %eax,0x18(%rsp)
    2c82:	74 10                	je     2c94 <__sprintf_chk@plt+0x524>*/
        int buffer_size = 0x2001;
        char * buffer = NULL;
        int var_0x18 = 0;

        #if 0
        if (is_selinux_enabled() == gvar_92c8) {
            // je 2c94
        }
        #endif

    /*2c84:	8b 05 3a 66 00 00    	mov    0x663a(%rip),%eax        # 92c4 <_IO_stdin_used@@Base+0x32c4>    // gvar_92c4 = 113
    2c8a:	83 c0 01             	add    $0x1,%eax*/
        gvar_92c4 += 1;

    /*2c8d:	48 98                	cltq   
    2c8f:	48 89 44 24 20       	mov    %rax,0x20(%rsp)*/    // (rsp+0x20)=buffer_size
        buffer_size = gvar_92c4;

    /*2c94:	83 3d cd 67 00 00 00 	cmpl   $0x0,0x67cd(%rip)        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468=0
    2c9b:	0f 84 fa 06 00 00    	je     339b <__sprintf_chk@plt+0xc2b> */        
        if (gvar_9468 == 0) {
            // je 339b
            buffer = NULL;
        }
        else {

    /*2ca1:	48 8b 7c 24 20       	mov    0x20(%rsp),%rdi      // rdi=buffer_size
    2ca6:	e8 95 f9 ff ff       	callq  2640 <malloc@plt>
    2cab:	48 89 44 24 30       	mov    %rax,0x30(%rsp)*/    // (rsp+0x30)=buffer
            buffer = (char *)malloc(buffer_size);

    /*2cb0:	48 85 c0             	test   %rax,%rax
    2cb3:	0f 84 82 0d 00 00    	je     3a3b <__sprintf_chk@plt+0x12cb>*/
            if (buffer == NULL) {
                // je 3a3b
                perror("malloc error.");
                exit(1);
            }
        }

    /* je 339b --> jmpq   2cb9 */
    /*2cb9:	48 8d 3d 0b 35 00 00 	lea    0x350b(%rip),%rdi        # 61cb <_IO_stdin_used@@Base+0x1cb> // char *gvar_61cb="/proc"
    2cc0:	41 bf 01 00 00 00    	mov    $0x1,%r15d*/             // r15d=1
            int var_r15d = 1;           // var_r15d = empty

    /*2cc6:	e8 05 f8 ff ff       	callq  24d0 <opendir@plt> */
        DIR * pdir = opendir(gvar_61cb);    // open /proc

    /*2ccb:	49 89 c4             	mov    %rax,%r12            // r12=pdir
    2cce:	48 85 c0             	test   %rax,%rax            // rax=pdir
    2cd1:	0f 84 4e 0d 00 00    	je     3a25 <__sprintf_chk@plt+0x12b5>*/
        if (pdir == NULL) {
            // je 3a25
            perror("opendir error...");
            exit(1);
        }

    /*2cd7:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
    2cde:	00 00 
    2ce0:	4c 89 e7             	mov    %r12,%rdi            // r12=pdir
    2ce3:	e8 48 f9 ff ff       	callq  2630 <readdir@plt>
    2ce8:	48 85 c0             	test   %rax,%rax */         // rax=dp
        struct dirent * dp = NULL;
        char *ptr;
        char *path = NULL;
        FILE *fp = NULL;

        while ((dp = readdir(pdir)) != NULL) {

    /*2ceb:	0f 84 b5 01 00 00    	je     2ea6 <__sprintf_chk@plt+0x736>   // 条件不成立时跳出while循环
    2cf1:	48 8d 68 13          	lea    0x13(%rax),%rbp      // rbp=dp->d_name
    2cf5:	48 8d b4 24 98 00 00 	lea    0x98(%rsp),%rsi      // rsi=rsp+0x98=ptr
    2cfc:	00 
    2cfd:	ba 0a 00 00 00       	mov    $0xa,%edx            // edx=0xa
    2d02:	48 89 ef             	mov    %rbp,%rdi
    2d05:	e8 f6 f8 ff ff       	callq  2600 <strtol@plt>*/
            pid = strtol(dp->d_name, &ptr, 0xa);
            if (*ptr != '\0')
                printf("ptr=%s\n", ptr);

    /*2d0a:	48 89 c3             	mov    %rax,%rbx            // rbx=pid
    2d0d:	48 8b 84 24 98 00 00 	mov    0x98(%rsp),%rax      // rax=ptr
    2d14:	00 
    2d15:	48 39 c5             	cmp    %rax,%rbp            // rax=ptr, rbp=dp->d_name
    2d18:	74 c6                	je     2ce0 <__sprintf_chk@plt+0x570>            
    2d1a:	80 38 00             	cmpb   $0x0,(%rax)
    2d1d:	75 c1                	jne    2ce0 <__sprintf_chk@plt+0x570>*/
            if ((ptr == dp->d_name) && *ptr != '\0') {
                // je 2ce0
                continue;
            }
            else if ((ptr != dp->d_name) && *ptr == '\0') {

    /*2d1f:	48 89 ef             	mov    %rbp,%rdi            // rbp=dp->d_name
    2d22:	e8 e9 f7 ff ff       	callq  2510 <strlen@plt>
    2d27:	48 8d 78 0f          	lea    0xf(%rax),%rdi       // rax=strlen()+15
    2d2b:	e8 10 f9 ff ff       	callq  2640 <malloc@plt>*/
                path = (char *)malloc(strlen(dp->d_name) + 0xf);
            
    /*2d30:	49 89 c6             	mov    %rax,%r14            // r14=path
    2d33:	48 85 c0             	test   %rax,%rax
    2d36:	0f 84 df 0c 00 00    	je     3a1b <__sprintf_chk@plt+0x12ab>*/
                if (path == NULL) {
                    // je 3a1b
                    perror("path error.");
                    exit(1);
                }

    /*2d3c:	48 89 c7             	mov    %rax,%rdi            // rdi=path
    2d3f:	41 89 d9             	mov    %ebx,%r9d            // r9d = pid
    2d42:	4c 8d 05 82 34 00 00 	lea    0x3482(%rip),%r8        # 61cb <_IO_stdin_used@@Base+0x1cb>  // char *gvar_61cb="/proc"
    2d49:	31 c0                	xor    %eax,%eax
    2d4b:	48 8d 0d 7f 34 00 00 	lea    0x347f(%rip),%rcx        # 61d1 <_IO_stdin_used@@Base+0x1d1> // rcx="%s/%d/stat"
    2d52:	48 c7 c2 ff ff ff ff 	mov    $0xffffffffffffffff,%rdx // rdx=-1
    2d59:	be 01 00 00 00       	mov    $0x1,%esi                // esi=1
    2d5e:	89 5c 24 10          	mov    %ebx,0x10(%rsp)          // (rsp+0x10)=pid
    2d62:	e8 09 fa ff ff       	callq  2770 <__sprintf_chk@plt> */
                sprintf(path, "%s/%d/stat", gvar_61cb, pid);
                printf("path=%s\n", path);

    /*2d67:	48 8d 35 c2 35 00 00 	lea    0x35c2(%rip),%rsi        # 6330 <_IO_stdin_used@@Base+0x330> // rsi="r"
    2d6e:	4c 89 f7             	mov    %r14,%rdi
    2d71:	e8 5a f9 ff ff       	callq  26d0 <fopen@plt>*/
                fp = fopen(path, "r");
        
    /*2d76:	49 89 c5             	mov    %rax,%r13                // r13=fp
    2d79:	48 85 c0             	test   %rax,%rax
    2d7c:	0f 84 0b 01 00 00    	je     2e8d <__sprintf_chk@plt+0x71d>*/
                if (fp != NULL) {

    /*2d82:	41 89 d9             	mov    %ebx,%r9d                // r9d=pid
    2d85:	4c 8d 05 3f 34 00 00 	lea    0x343f(%rip),%r8        # 61cb <_IO_stdin_used@@Base+0x1cb>  // char *gvar_61cb="/proc"
    2d8c:	4c 89 f7             	mov    %r14,%rdi                // rdi=r14=path
    2d8f:	31 c0                	xor    %eax,%eax
    2d91:	48 8d 0d 44 34 00 00 	lea    0x3444(%rip),%rcx        # 61dc <_IO_stdin_used@@Base+0x1dc> // "%s/%d"
    2d98:	48 c7 c2 ff ff ff ff 	mov    $0xffffffffffffffff,%rdx // rdx=-1
    2d9f:	be 01 00 00 00       	mov    $0x1,%esi                // esi=1
    2da4:	e8 c7 f9 ff ff       	callq  2770 <__sprintf_chk@plt>*/
                sprintf(path, "%s/%d", gvar_61cb, pid);
                printf("path=%s\n", path);

    /*2da9:	44 8b 54 24 18       	mov    0x18(%rsp),%r10d         // r10d = var_0x18
    2dae:	45 85 d2             	test   %r10d,%r10d
    2db1:	7e 17                	jle    2dca <__sprintf_chk@plt+0x65a>*/
                if (var_0x18 > 0) {

    /*2db3:	48 8d b4 24 a0 00 00 	lea    0xa0(%rsp),%rsi
    2dba:	00 
    2dbb:	89 df                	mov    %ebx,%edi                // edi=pid
    2dbd:	e8 7e f9 ff ff       	callq  2740 <getpidcon@plt>
    2dc2:	85 c0                	test   %eax,%eax
    2dc4:	0f 88 3f 0c 00 00    	js     3a09 <__sprintf_chk@plt+0x1299>*/    // js --> < 0
                }
                
    /*2dca:	48 8d 94 24 b0 00 00 	lea    0xb0(%rsp),%rdx          // rdx=(rsp+0xb0)=&st
    2dd1:	00 
    2dd2:	4c 89 f6             	mov    %r14,%rsi                // rsi=r14=path
    2dd5:	bf 01 00 00 00       	mov    $0x1,%edi                // edi=1
    2dda:	e8 41 f8 ff ff       	callq  2620 <__xstat@plt>
    2ddf:	85 c0                	test   %eax,%eax                
    2de1:	0f 88 22 0c 00 00    	js     3a09 <__sprintf_chk@plt+0x1299>*/
                struct stat st;
                if (stat(path, &st) < 0) {
                    // js 3a09
                    perror("stat error");
                    exit(1);
                }

    /*2de7:	48 8d ac 24 e0 07 00 	lea    0x7e0(%rsp),%rbp
    2dee:	00 */
            char read_buf[0x2000] = {0};
            int fread_size = 0;
            int pgid = 0, ppid = 0;
            unsigned long long proc_stt_jf = 0;
            char *strchr_ret = NULL, *strrchr_ret = NULL;

    /*2def:	4c 89 e9             	mov    %r13,%rcx                // r13=fp
    2df2:	ba 00 20 00 00       	mov    $0x2000,%edx
    2df7:	be 01 00 00 00       	mov    $0x1,%esi
    2dfc:	48 89 ef             	mov    %rbp,%rdi                // rdi=read_buf
    2dff:	e8 7c f6 ff ff       	callq  2480 <fread@plt>*/
            fread_size = fread(read_buf, 1, 0x2000, fp);

    /*2e04:	4c 89 ef             	mov    %r13,%rdi                // r13=fp
    2e07:	48 89 44 24 08       	mov    %rax,0x8(%rsp)           // (rsp+0x8)=fread_size
    2e0c:	e8 4f f6 ff ff       	callq  2460 <ferror@plt>
    2e11:	41 89 c7             	mov    %eax,%r15d               // r15d=ferror(fp)
    2e14:	85 c0                	test   %eax,%eax
    2e16:	75 6a                	jne    2e82 <__sprintf_chk@plt+0x712>*/
            if (ferror(fp) != 0) {
                // jne 2e82
            }
            else {
    /*2e18:	48 63 44 24 08       	movslq 0x8(%rsp),%rax       // rax=fread_size
    2e1d:	48 89 ef             	mov    %rbp,%rdi            // rdi=read_buf
    2e20:	be 28 00 00 00       	mov    $0x28,%esi           // esi=0x28
    2e25:	c6 84 04 e0 07 00 00 	movb   $0x0,0x7e0(%rsp,%rax,1)  // (rsp+fread_size*1)+read_buf = 0
    2e2c:	00 */
                read_buf[fread_size] = 0;

    /*2e2d:	e8 0e f7 ff ff       	callq  2540 <strchr@plt>
    2e32:	48 89 c5             	mov    %rax,%rbp            // rbp=strchr_ret
    2e35:	48 85 c0             	test   %rax,%rax
    2e38:	74 48                	je     2e82 <__sprintf_chk@plt+0x712>*/                
                strchr_ret = strchr(read_buf, 0x28);

    /*2e3a:	be 29 00 00 00       	mov    $0x29,%esi
    2e3f:	48 89 c7             	mov    %rax,%rdi            // rdi=rax=strchr_ret
    2e42:	e8 09 f7 ff ff       	callq  2550 <strrchr@plt>*/
                strrchr_ret = strrchr(strchr_ret, 0x29);

    /*2e47:	48 85 c0             	test   %rax,%rax
    2e4a:	74 36                	je     2e82 <__sprintf_chk@plt+0x712>*/
                if (strchr_ret == NULL && strrchr_ret == NULL) {
                    // je 2e82
                }
                else {
                     *strrchr_ret = 0;

    /*2e4c:	c6 00 00             	movb   $0x0,(%rax)
    2e4f:	48 8d 78 02          	lea    0x2(%rax),%rdi       // strrchr_ret+2
    2e53:	48 8d 8c 24 84 00 00 	lea    0x84(%rsp),%rcx      // rcx=&pgid
    2e5a:	00 
    2e5b:	31 c0                	xor    %eax,%eax
    2e5d:	48 8d 94 24 80 00 00 	lea    0x80(%rsp),%rdx      // rdx=&ppid
    2e64:	00 
    2e65:	4c 8d 84 24 a8 00 00 	lea    0xa8(%rsp),%r8       // r8=proc_stt_jf
    2e6c:	00 
    2e6d:	48 8d 35 8c 3c 00 00 	lea    0x3c8c(%rip),%rsi        # 6b00 <_IO_stdin_used@@Base+0xb00> // "%*c %d %d %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %Lu"
    2e74:	e8 e7 f7 ff ff       	callq  2660 <__isoc99_sscanf@plt>*/
                    int sscanf_ret = sscanf(strrchr_ret + 2, 
                                        "%*c %d %d %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %*s %Lu",
                                        &ppid, &pgid, &proc_stt_jf);

    /*2e79:	83 f8 03             	cmp    $0x3,%eax
    2e7c:	0f 84 27 05 00 00    	je     33a9 <__sprintf_chk@plt+0xc39>*/
                    if (sscanf_ret == 3) {
                        // je 33a9      ===>
                    }   /* if (sscanf_ret == 3) */
                }   /* if (strchr_ret == NULL && strrchr_ret == NULL) */
            }   /* if (ferror(fp) != 0) */

    /*2e82:	4c 89 ef             	mov    %r13,%rdi            // r13=fp
    2e85:	45 31 ff             	xor    %r15d,%r15d
    2e88:	e8 33 f6 ff ff       	callq  24c0 <fclose@plt>*/
            fclose(fp);

          }   /* if (fp != NULL) */
    /*2e8d:	4c 89 f7             	mov    %r14,%rdi
    2e90:	e8 6b f5 ff ff       	callq  2400 <free@plt>*/
        free(path);

    /*2e95:	4c 89 e7             	mov    %r12,%rdi            // r12=pdir
    2e98:	e8 93 f7 ff ff       	callq  2630 <readdir@plt>
    2e9d:	48 85 c0             	test   %rax,%rax
    2ea0:	0f 85 4b fe ff ff    	jne    2cf1 <__sprintf_chk@plt+0x581>*/
            }   /* if ((ptr != dp->d_name) && *ptr == '\0') */
        }   /* while ((dp = readdir64(pdir)) != NULL) */
    
    /*2ea6:	4c 89 e7             	mov    %r12,%rdi            // r12=pdir
    2ea9:	e8 e2 f6 ff ff       	callq  2590 <closedir@plt>*/
        closedir(pdir);

    /*2eae:	48 8b 2d d3 65 00 00 	mov    0x65d3(%rip),%rbp        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // rbp=gvar_9488
    2eb5:	48 85 ed             	test   %rbp,%rbp
    2eb8:	0f 84 83 01 00 00    	je     3041 <__sprintf_chk@plt+0x8d1>
    2ebe:	49 89 ec             	mov    %rbp,%r12        // r12=rbp=temp=gvar_9488
    2ec1:	eb 16                	jmp    2ed9 <__sprintf_chk@plt+0x769>
    2ec3:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)*/
        PROC *temp = NULL, *walk = NULL;

        for (temp = gvar_9488; temp; temp = temp->next) {
            
    /*
     * r12=(0x555555588ac0+0xc0=0x555555588b80):0x5555555889d0: "kworker/u256:1-events_power_efficient"
     * r12=(0x5555555889d0+0xc0=0x555555588a90):0x5555555888e0: "kworker/0:2-events"
     * r12=(0x5555555888e0+0xc0=0x5555555889a0):0x5555555887f0: "kworker/0:0-events"
     * r12=(0x5555555887f0+0xc0=0x5555555888b0):0x555555588700: "kworker/3:0-mm_percpu_wq"
     * r12=(0x555555588700+0xc0=0x5555555887c0):0x555555588610: "kworker/1:0-mm_percpu_wq"
     * r12=(0x555555588610+0xc0=0x5555555886d0):0x555555588520: "kworker/2:0-events"
     *
     */
    /*2ec8:	4d 8b a4 24 c0 00 00 	mov    0xc0(%r12),%r12          // temp = temp->next
    2ecf:	00 
    2ed0:	4d 85 e4             	test   %r12,%r12
    2ed3:	0f 84 68 01 00 00    	je     3041 <__sprintf_chk@plt+0x8d1>

    2ed9:	41 83 7c 24 54 01    	cmpl   $0x1,0x54(%r12)  // 
    2edf:	75 e7                	jne    2ec8 <__sprintf_chk@plt+0x758>*/
            if (temp->pid == 1) {
                break;
            }
         }  /* for (temp = gvar_9488; temp, temp = temp->next) */

    /*2ee1:	48 89 eb             	mov    %rbp,%rbx        // rbx=walk=gvar_9488
    2ee4:	eb 1a                	jmp    2f00 <__sprintf_chk@plt+0x790>*/         

    /*2ee6:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    2eed:	00 00 00 
    2ef0:	48 8b 9b c0 00 00 00 	mov    0xc0(%rbx),%rbx  // rbx=walk=gvar_9488->next
    2ef7:	48 85 db             	test   %rbx,%rbx        // walk ?= NULL
    2efa:	0f 84 6f 01 00 00    	je     306f <__sprintf_chk@plt+0x8ff>*/     // 跳出for

        if (temp != NULL) {
    /*2f00:	83 7b 54 01          	cmpl   $0x1,0x54(%rbx)  // gvar_9488->pid
    2f04:	76 ea                	jbe    2ef0 <__sprintf_chk@plt+0x780>
    2f06:	48 83 bb b8 00 00 00 	cmpq   $0x0,0xb8(%rbx)  // gvar_9488->parent
    2f0d:	00 
    2f0e:	75 e0                	jne    2ef0 <__sprintf_chk@plt+0x780>
    2f10:	48 89 de             	mov    %rbx,%rsi        // rsi=walk
    2f13:	4c 89 e7             	mov    %r12,%rdi        // rdi=temp
    2f16:	e8 05 20 00 00       	callq  4f20 <__sprintf_chk@plt+0x27b0>  // fun_4f20(PROC *a, PROC * b)
    2f1b:	4c 89 a3 b8 00 00 00 	mov    %r12,0xb8(%rbx)  // walk->parent=temp
    2f22:	eb cc                	jmp    2ef0 <__sprintf_chk@plt+0x780>*/
            for (walk = gvar_9488; walk; walk = walk->next) {
                if (walk->pid == 1 || walk->pid == 0)
                    continue;
                if (walk->parent == NULL) {
                    fun_4f20(temp, walk);
                    walk->parent = temp;
                }
            }
        }  /* if (temp != NULL) */

    #if 0
    int get_ws_col() {}

	/* getenv("COLUMNS") != 0, goto here */
    /*2f24:	31 d2                	xor    %edx,%edx		// edx=0
    2f26:	48 8d b4 24 a0 00 00 	lea    0xa0(%rsp),%rsi	// rsi=(rsp+0xa0)=*ptr_strtol
    2f2d:	00 
    2f2e:	48 89 c7             	mov    %rax,%rdi		// rdi=rax=p_getenv="113"
    2f31:	e8 ca f6 ff ff       	callq  2600 <strtol@plt>    // rax=113=strtol(p_getenv, &ptr_strtol, 0);
    2f36:	48 8b 94 24 a0 00 00 	mov    0xa0(%rsp),%rdx	// rdx=""=*ptr_strtol
    2f3d:	00 
    2f3e:	80 3a 00             	cmpb   $0x0,(%rdx)      // (rdx) = 0
    2f41:	0f 85 bf f8 ff ff    	jne    2806 <__sprintf_chk@plt+0x96>    // no jump
    2f47:	48 8d 50 ff          	lea    -0x1(%rax),%rdx  // rdx=rax-1=112
    2f4b:	48 81 fa fd ff ff 7f 	cmp    $0x7ffffffd,%rdx // rdx=112
    2f52:	0f 87 ae f8 ff ff    	ja     2806 <__sprintf_chk@plt+0x96>    // (CF or ZF) = 0 is jump, here no jump
    2f58:	e9 dd f8 ff ff       	jmpq   283a <__sprintf_chk@plt+0xca> */ /* getenv("COLUMNS") != 0, end */

    /* 2f5d:	48 8d 3d 19 32 00 00 	lea    0x3219(%rip),%rdi        # 617d <_IO_stdin_used@@Base+0x17d> // "TERM"
    2f64:	e8 77 f4 ff ff       	callq  23e0 <getenv@plt>            // getenv("TERM")
    2f69:	48 85 c0             	test   %rax,%rax                    // rax&rax
    2f6c:	0f 84 67 f9 ff ff    	je     28d9 <__sprintf_chk@plt+0x169>   // rax=0, -> 28d9
    2f72:	80 38 00             	cmpb   $0x0,(%rax)                      // (rax)?0
    2f75:	0f 84 5e f9 ff ff    	je     28d9 <__sprintf_chk@plt+0x169>   // (rax)=0, -> 28d9
    2f7b:	31 d2                	xor    %edx,%edx        // edx=0
    2f7d:	31 ff                	xor    %edi,%edi        // edi=0
    2f7f:	be 01 00 00 00       	mov    $0x1,%esi        // esi=0x1
    2f84:	e8 07 f7 ff ff       	callq  2690 <setupterm@plt> // setupterm(0, 1, 0)
    2f89:	85 c0                	test   %eax,%eax
    2f8b:	0f 85 48 f9 ff ff    	jne    28d9 <__sprintf_chk@plt+0x169>   // setupterm(0, 1, 0) != 0, --> 28d9
    2f91:	48 8d 3d ea 31 00 00 	lea    0x31ea(%rip),%rdi        # 6182 <_IO_stdin_used@@Base+0x182> // "acsc"
    2f98:	e8 13 f7 ff ff       	callq  26b0 <tigetstr@plt>      // tigetstr("acsc")
    2f9d:	48 85 c0             	test   %rax,%rax
    2fa0:	0f 84 33 f9 ff ff    	je     28d9 <__sprintf_chk@plt+0x169>
    2fa6:	48 8d 3d d5 31 00 00 	lea    0x31d5(%rip),%rdi        # 6182 <_IO_stdin_used@@Base+0x182> // "acsc"
    2fad:	e8 fe f6 ff ff       	callq  26b0 <tigetstr@plt>      // tigetstr("acsc")
    2fb2:	e9 22 f9 ff ff       	jmpq   28d9 <__sprintf_chk@plt+0x169> */
    #endif

    /* if (optind == argc - 1) */
    /*2fb7:	e8 a4 f7 ff ff       	callq  2760 <__ctype_b_loc@plt>
    2fbc:	48 63 db             	movslq %ebx,%rbx
    2fbf:	49 8b 3c dc          	mov    (%r12,%rbx,8),%rdi
    2fc3:	48 8b 00             	mov    (%rax),%rax
    2fc6:	48 0f be 17          	movsbq (%rdi),%rdx
    2fca:	f6 44 50 01 08       	testb  $0x8,0x1(%rax,%rdx,2)
    2fcf:	89 2d 23 64 00 00    	mov    %ebp,0x6423(%rip)        # 93f8 <optind@@GLIBC_2.2.5>    // 93f8 = optind
    2fd5:	0f 85 d7 05 00 00    	jne    35b2 <__sprintf_chk@plt+0xe42>
    2fdb:	e8 10 f6 ff ff       	callq  25f0 <getpwnam@plt>
    2fe0:	c7 44 24 38 00 00 00 	movl   $0x0,0x38(%rsp)          // (rsp+0x38)=pid_set
    2fe7:	00 
    2fe8:	48 89 44 24 28       	mov    %rax,0x28(%rsp)
    2fed:	c7 44 24 3c 01 00 00 	movl   $0x1,0x3c(%rsp)          // (rsp+0x3c)=pid
    2ff4:	00 
    2ff5:	48 85 c0             	test   %rax,%rax
    2ff8:	0f 85 47 fc ff ff    	jne    2c45 <__sprintf_chk@plt+0x4d5>
    2ffe:	48 63 05 f3 63 00 00 	movslq 0x63f3(%rip),%rax        # 93f8 <optind@@GLIBC_2.2.5>    // 93f8 = optind
    3005:	ba 05 00 00 00       	mov    $0x5,%edx
    300a:	48 8d 35 a3 31 00 00 	lea    0x31a3(%rip),%rsi        # 61b4 <_IO_stdin_used@@Base+0x1b4>
    3011:	4d 8b 64 c4 f8       	mov    -0x8(%r12,%rax,8),%r12 */

    #if 0
    // getopt_long 不满足有条件跳转到此
    /*3016:	31 ff                	xor    %edi,%edi
    3018:	41 bf 01 00 00 00    	mov    $0x1,%r15d
    301e:	e8 dd f4 ff ff       	callq  2500 <dcgettext@plt>
    3023:	48 8b 3d f6 63 00 00 	mov    0x63f6(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    302a:	4c 89 e1             	mov    %r12,%rcx
    302d:	be 01 00 00 00       	mov    $0x1,%esi
    3032:	48 89 c2             	mov    %rax,%rdx
    3035:	31 c0                	xor    %eax,%eax
    3037:	e8 e4 f6 ff ff       	callq  2720 <__fprintf_chk@plt>
    303c:	e9 3a f9 ff ff       	jmpq   297b <__sprintf_chk@plt+0x20b> */    // 297b 跳转到此为程序结束
        fprintf(stderr, "%s", "procfs file for %s namespace not available\n");
    #endif
        
    /*3041:	48 8b 8c 24 a0 00 00 	mov    0xa0(%rsp),%rcx          // rcx=
    3048:	00 
    3049:	31 d2                	xor    %edx,%edx                // edx=0
    304b:	be 01 00 00 00       	mov    $0x1,%esi                // esi=1
    3050:	48 8d 3d d6 30 00 00 	lea    0x30d6(%rip),%rdi        # 612d <_IO_stdin_used@@Base+0x12d> // "?"
    3057:	e8 74 1f 00 00       	callq  4fd0 <__sprintf_chk@plt+0x2860>  // fun_4fd0(comm, pid, uid)
    305c:	48 8b 2d 25 64 00 00 	mov    0x6425(%rip),%rbp        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // rbp=gvar_9488
    3063:	49 89 c4             	mov    %rax,%r12                // r12=rax=temp
    3066:	48 85 ed             	test   %rbp,%rbp                // gvar_9488 ?= NULL
    3069:	0f 85 72 fe ff ff    	jne    2ee1 <__sprintf_chk@plt+0x771>*/ // 流程控制，表明后面接for (walk = gvar_9488; walk; walk = walk->next)
        if (temp == NULL) {
            // je 3041
            temp = fun_4fd0("?", 1, 0);
        }   /* if (temp == NULL) */

    /*306f:	83 3d f2 63 00 00 00 	cmpl   $0x0,0x63f2(%rip)        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468
    3076:	0f 85 0f 05 00 00    	jne    358b <__sprintf_chk@plt+0xe1b>*/
        if (gvar_9468 != 0) {
            // jne 358b
            free(buffer);
        }   /* if (gvar_9468 != 0) */

    /*307c:	45 85 ff             	test   %r15d,%r15d
    307f:	0f 85 cc 09 00 00    	jne    3a51 <__sprintf_chk@plt+0x12e1>*/
        if (var_r15d) {
            // jne 3a51
            fprintf(stderr, "%s is empty (not mounted ?)\n", "/proc");
            exit(1);
        }

    /*3085:	8b 54 24 04          	mov    0x4(%rsp),%edx       // edx=(rsp+0x4)=highlight
    3089:	48 89 e8             	mov    %rbp,%rax            // rax=rbp=gvar_9488
    308c:	48 85 ed             	test   %rbp,%rbp            // gvar_9488 ?= NULL
    308f:	75 1b                	jne    30ac <__sprintf_chk@plt+0x93c>
    3091:	e9 be 05 00 00       	jmpq   3654 <__sprintf_chk@plt+0xee4>
    3096:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    309d:	00 00 00 */

    /*30a0:	48 8b 80 c0 00 00 00 	mov    0xc0(%rax),%rax      // rax=gvar_9488->next
    30a7:	48 85 c0             	test   %rax,%rax            // gvar_9488 ?= NULL
    30aa:	74 1f                	je     30cb <__sprintf_chk@plt+0x95b>

    30ac:	3b 50 54             	cmp    0x54(%rax),%edx      // gvar_9488->pid
    30af:	75 ef                	jne    30a0 <__sprintf_chk@plt+0x930>
    30b1:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)

    30b8:	80 88 a0 00 00 00 01 	orb    $0x1,0xa0(%rax)      // gvar_9488->flags |= 0x1
    30bf:	48 8b 80 b8 00 00 00 	mov    0xb8(%rax),%rax      // rax=gvar_9488->parent
    30c6:	48 85 c0             	test   %rax,%rax            // != NULL
    30c9:	75 ed                	jne    30b8 <__sprintf_chk@plt+0x948>*/
        PROC *current, *child_proc;

        for (current = find_proc(highlight); current; current = current->parent)
            current->flags |= 0x1;

    /*30cb:	83 3d 86 63 00 00 00 	cmpl   $0x0,0x6386(%rip)        # 9458 <stderr@@GLIBC_2.2.5+0x38>   // gvar_9458
    30d2:	74 0b                	je     30df <__sprintf_chk@plt+0x96f>   // gvar_9458 == 0
    30d4:	83 7c 24 38 00       	cmpl   $0x0,0x38(%rsp)                  // (rsp+0x38)=pid_set
    30d9:	0f 85 10 05 00 00    	jne    35ef <__sprintf_chk@plt+0xe7f>*/ // pid_set != 0
        if(gvar_9458 && pid_set == 1) {
            PROC *child_proc;

            if ( (child_proc = find_proc(pid)) == NULL) {
              fprintf(stderr, "Process %d not found.\n", pid);
              return 1;
            }
            trim_tree_by_parent(child_proc);
            pid = 1;
        }

    /*30df:	8b 74 24 1c          	mov    0x1c(%rsp),%esi      // (rsp+0x1c)=nsid
    30e3:	83 fe 07             	cmp    $0x7,%esi
    30e6:	0f 84 2f 02 00 00    	je     331b <__sprintf_chk@plt+0xbab>*/
        struct ns_entry *ns_ptr = nsroot;
        CHILD *c;
        char buff[14];
        char *str = NULL;

        if (nsid != 0x7) {

    /*30ec:	48 8d 94 24 88 00 00 	lea    0x88(%rsp),%rdx      // rdx=nsroot
    30f3:	00 
    30f4:	31 ff                	xor    %edi,%edi            // edi=NULL
    30f6:	48 8d ac 24 f0 27 00 	lea    0x27f0(%rsp),%rbp    // rbp=buff[]
    30fd:	00 
    30fe:	e8 ad 0c 00 00       	callq  3db0 <__sprintf_chk@plt+0x1640>*/
            fun_3db0(NULL, nsid, &nsroot);

    /*3103:	48 8b 9c 24 88 00 00 	mov    0x88(%rsp),%rbx      // (rsp+0x88)=ns_ptr=*nsroot
    310a:	00 
    310b:	4c 8d 25 5b 31 00 00 	lea    0x315b(%rip),%r12        # 626d <_IO_stdin_used@@Base+0x26d> // "[%li]\n"
    3112:	48 85 db             	test   %rbx,%rbx            // nsroot ?= NULL
    3115:	0f 84 91 00 00 00    	je     31ac <__sprintf_chk@plt+0xa3c>
    311b:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)*/
            for (; ns_ptr; ns_ptr = ns_ptr->next) {

    /*3120:	4c 8b 0b             	mov    (%rbx),%r9       // r9=ns_ptr->nmber
    3123:	48 89 ef             	mov    %rbp,%rdi        // rdi=buff
    3126:	4d 89 e0             	mov    %r12,%r8         // r8="[%li]\n"
    3129:	b9 0e 00 00 00       	mov    $0xe,%ecx        // ecx=0xe
    312e:	ba 01 00 00 00       	mov    $0x1,%edx        // edx=1
    3133:	be 0e 00 00 00       	mov    $0xe,%esi        // esi=0xe
    3138:	31 c0                	xor    %eax,%eax        // eax=0
    313a:	49 89 ed             	mov    %rbp,%r13        // r13=buff
    313d:	e8 ae f2 ff ff       	callq  23f0 <__snprintf_chk@plt>*/
            snprintf(buff, sizeof(buff), "[%li]\n", (long int)ns_ptr->number);

    /*3142:	0f be bc 24 f0 27 00 	movsbl 0x27f0(%rsp),%edi    // edi=buff
    3149:	00 
    314a:	40 84 ff             	test   %dil,%dil        // di=edi&0xffff ?= NULL
    314d:	74 14                	je     3163 <__sprintf_chk@plt+0x9f3>
    314f:	90                   	nop*/
    
    /*3150:	e8 3b 0e 00 00       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(buff)
    3155:	41 0f be 7d 01       	movsbl 0x1(%r13),%edi
    315a:	49 83 c5 01          	add    $0x1,%r13
    315e:	40 84 ff             	test   %dil,%dil        // di=edi&0xffff ?= NULL    
    3161:	75 ed                	jne    3150 <__sprintf_chk@plt+0x9e0>*/
            str = buff;
            while (*str)
                fun_3f90(*str++);

    /*3163:	4c 8b 6b 08          	mov    0x8(%rbx),%r13   // r13=c=prt->children
    3167:	4d 85 ed             	test   %r13,%r13*/      // r13=c->children ?= NULL
            for (c = ns_ptr->children; c; c = c->next) {

    /*316a:	74 33                	je     319f <__sprintf_chk@plt+0xa2f>
    316c:	0f 1f 40 00          	nopl   0x0(%rax)
    3170:	48 83 ec 08          	sub    $0x8,%rsp
    3174:	49 8b 7d 00          	mov    0x0(%r13),%rdi   // rdi=c->child
    3178:	31 f6                	xor    %esi,%esi        // esi=0
    317a:	45 31 c9             	xor    %r9d,%r9d        // r9d=0
    317d:	6a 00                	pushq  $0x0
    317f:	41 b8 01 00 00 00    	mov    $0x1,%r8d        // r8d=1
    3185:	b9 01 00 00 00       	mov    $0x1,%ecx        // ecx=1
    318a:	ba 01 00 00 00       	mov    $0x1,%edx        // edx=1
    318f:	e8 ac 11 00 00       	callq  4340 <__sprintf_chk@plt+0x1bd0>*/  // fun_4340()
                fun_4340(c->child, 0, 1, 1, 1, 0, 0);

    /*3194:	4d 8b 6d 08          	mov    0x8(%r13),%r13   // r13=c->next
    3198:	5e                   	pop    %rsi             // rsi=0
    3199:	5f                   	pop    %rdi
    319a:	4d 85 ed             	test   %r13,%r13        // r13=c->next ?= NULL
    319d:	75 d1                	jne    3170 <__sprintf_chk@plt+0xa00>
    319f:	48 8b 5b 10          	mov    0x10(%rbx),%rbx  // rbx=nsroot->next
    31a3:	48 85 db             	test   %rbx,%rbx        // nsroot->next ?= NULL
    31a6:	0f 85 74 ff ff ff    	jne    3120 <__sprintf_chk@plt+0x9b0>*/
                }
            }
        }   /* if (nsid != 0x7) */

    /*31ac:	48 8b 3d c5 62 00 00 	mov    0x62c5(%rip),%rdi        # 9478 <stderr@@GLIBC_2.2.5+0x58>   //gvar_9478
    31b3:	48 85 ff             	test   %rdi,%rdi
    31b6:	74 10                	je     31c8 <__sprintf_chk@plt+0xa58>*/
        if (gvar_9478 != NULL) {

    /*31b8:	e8 43 f2 ff ff       	callq  2400 <free@plt>
    31bd:	48 c7 05 b0 62 00 00 	movq   $0x0,0x62b0(%rip)        # 9478 <stderr@@GLIBC_2.2.5+0x58>   // gvar_9478
    31c4:	00 00 00 00 */
            free(gvar_9478);
            gvar_9478 = NULL;
        }

    /*31c8:	48 8b 3d a1 62 00 00 	mov    0x62a1(%rip),%rdi        # 9470 <stderr@@GLIBC_2.2.5+0x50>   // gvar_9470
    31cf:	48 85 ff             	test   %rdi,%rdi
    31d2:	74 10                	je     31e4 <__sprintf_chk@plt+0xa74>*/
        if (gvar_9470 != 0) {
    
    /*31d4:	e8 27 f2 ff ff       	callq  2400 <free@plt>
    31d9:	48 c7 05 8c 62 00 00 	movq   $0x0,0x628c(%rip)        # 9470 <stderr@@GLIBC_2.2.5+0x50>   // gvar_9470
    31e0:	00 00 00 00 */
            free(gvar_9470);
            gvar_9470 = NULL;
        }

    /*31e4:	4c 8b 25 9d 62 00 00 	mov    0x629d(%rip),%r12        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // r12=walk1=gvar_9488
    31eb:	c7 05 8b 62 00 00 00 	movl   $0x0,0x628b(%rip)        # 9480 <stderr@@GLIBC_2.2.5+0x60>   // gvar_9480=0
    31f2:	00 00 00 */
        gvar_9480 = 0;

        PROC *walk1, *next1;
        CHILD *walk1_child, *next1_child;
        walk1 = gvar_9488;

    /*31f5:	4d 85 e4             	test   %r12,%r12                // gvar_9488 ?= NULL
    31f8:	74 5e                	je     3258 <__sprintf_chk@plt+0xae8>*/
        while (walk1 != NULL) {

    /*31fa:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
    3200:	4c 89 e5             	mov    %r12,%rbp                // rbp=walk1=gvar_9488
    3203:	4d 8b a4 24 c0 00 00 	mov    0xc0(%r12),%r12          // next1=walk1->next
    320a:	00 
    320b:	48 8b 9d b0 00 00 00 	mov    0xb0(%rbp),%rbx          // rbx=walk1_child=walk1->children
    3212:	48 85 db             	test   %rbx,%rbx                // walk1_child ?= NULL
    3215:	74 1a                	je     3231 <__sprintf_chk@plt+0xac1>
    3217:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
    321e:	00 00 */
            next1 = walk1->next;
            walk1_child = walk1->children;
            while (walk1_child != NULL) {

    /*3220:	48 89 df             	mov    %rbx,%rdi                // rdi=walk1_child
    3223:	48 8b 5b 08          	mov    0x8(%rbx),%rbx           // rbx=next1_child=walk1_child->next
    3227:	e8 d4 f1 ff ff       	callq  2400 <free@plt>          // free(walk1_child)
    322c:	48 85 db             	test   %rbx,%rbx
    322f:	75 ef                	jne    3220 <__sprintf_chk@plt+0xab0>*/
                next1_child = walk1_child->next;
                free(walk1_child);
                walk1_child = next1_child;
            };

    /*3231:	48 8b 45 48          	mov    0x48(%rbp),%rax          // walk1->argv
    3235:	48 85 c0             	test   %rax,%rax
    3238:	74 11                	je     324b <__sprintf_chk@plt+0xadb>
    323a:	48 8b 38             	mov    (%rax),%rdi
    323d:	e8 be f1 ff ff       	callq  2400 <free@plt>
    3242:	48 8b 7d 48          	mov    0x48(%rbp),%rdi          // walk1->argv
    3246:	e8 b5 f1 ff ff       	callq  2400 <free@plt>*/
            if (walk1->argv) {
                free(walk1->argv[0]);
                free(walk1->argv);
            }

    /*324b:	48 89 ef             	mov    %rbp,%rdi
    324e:	e8 ad f1 ff ff       	callq  2400 <free@plt>
    3253:	4d 85 e4             	test   %r12,%r12
    3256:	75 a8                	jne    3200 <__sprintf_chk@plt+0xa90>*/
            free(walk1);
            walk1 = next1;
        }

    /*3258:	48 8b ac 24 88 00 00 	mov    0x88(%rsp),%rbp      // rbp=walk2=(rsp+0x88)=*nsroot
    325f:	00 
    3260:	48 c7 05 1d 62 00 00 	movq   $0x0,0x621d(%rip)        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // gvar_9488=NULL
    3267:	00 00 00 00 */

        gvar_9488 = NULL;

        struct ns_entry *walk2, *next2;
        walk2 = nsroot;

    /*326b:	48 85 ed             	test   %rbp,%rbp            // walk2 ?= NULL
    326e:	74 36                	je     32a6 <__sprintf_chk@plt+0xb36>*/
        while (walk2 != NULL) {

    /*3270:	49 89 ec             	mov    %rbp,%r12            // r12=walk2
    3273:	48 8b 6d 10          	mov    0x10(%rbp),%rbp      // next2=walk2->next

    3277:	49 8b 5c 24 08       	mov    0x8(%r12),%rbx       // rbx=walk1_child=walk2->children
    327c:	48 85 db             	test   %rbx,%rbx
    327f:	74 18                	je     3299 <__sprintf_chk@plt+0xb29>
    3281:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    3288:	48 89 df             	mov    %rbx,%rdi            // rdi=walk1_child
    328b:	48 8b 5b 08          	mov    0x8(%rbx),%rbx       // rbx=walk1_child->next
    328f:	e8 6c f1 ff ff       	callq  2400 <free@plt>
    3294:	48 85 db             	test   %rbx,%rbx
    3297:	75 ef                	jne    3288 <__sprintf_chk@plt+0xb18>*/
            next2 = walk2->next;
            walk1_child = walk2->children;
            while (walk1_child != NULL) {
                next1_child = walk1_child->next;
                free(walk1_child);
                walk1_child = next1_child;
            }

    /*3299:	4c 89 e7             	mov    %r12,%rdi            // rdi=r12=walk2
    329c:	e8 5f f1 ff ff       	callq  2400 <free@plt>
    32a1:	48 85 ed             	test   %rbp,%rbp
    32a4:	75 ca                	jne    3270 <__sprintf_chk@plt+0xb00>*/
            free(walk2);
            walk2 = next2;
        }

    /*32a6:	83 3d a3 61 00 00 01 	cmpl   $0x1,0x61a3(%rip)        # 9450 <stderr@@GLIBC_2.2.5+0x30>   // gvar_9450
    32ad:	48 c7 84 24 88 00 00 	movq   $0x0,0x88(%rsp)      // (rsp+0x88)=*nsroot
    32b4:	00 00 00 00 00 
    32b9:	0f 85 bc f6 ff ff    	jne    297b <__sprintf_chk@plt+0x20b> */    // 297b 跳转到此为程序结束
        nsroot = NULL;
    
        if (gvar_9450 == 1) {
    /*32bf:	31 ff                	xor    %edi,%edi
    32c1:	ba 05 00 00 00       	mov    $0x5,%edx
    32c6:	48 8d 35 bc 2f 00 00 	lea    0x2fbc(%rip),%rsi        # 6289 <_IO_stdin_used@@Base+0x289> // "Press return to close\n"
    32cd:	e8 2e f2 ff ff       	callq  2500 <dcgettext@plt>
    32d2:	48 8b 3d 47 61 00 00 	mov    0x6147(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    32d9:	be 01 00 00 00       	mov    $0x1,%esi
    32de:	48 89 c2             	mov    %rax,%rdx
    32e1:	31 c0                	xor    %eax,%eax
    32e3:	e8 38 f4 ff ff       	callq  2720 <__fprintf_chk@plt>
    32e8:	48 8b 3d 01 61 00 00 	mov    0x6101(%rip),%rdi        # 93f0 <stdin@@GLIBC_2.2.5>
    32ef:	e8 5c f4 ff ff       	callq  2750 <getc@plt>*/
            fprintf(stderr, "Press return to close\n");
            (void) getchar();
        }

    /*32f4:	e9 82 f6 ff ff       	jmpq   297b <__sprintf_chk@plt+0x20b>       // 297b 跳转到此为程序结束
    32f9:	48 8b 0d 20 61 00 00 	mov    0x6120(%rip),%rcx        # 9420 <stderr@@GLIBC_2.2.5>
    3300:	ba 39 00 00 00       	mov    $0x39,%edx
    3305:	be 01 00 00 00       	mov    $0x1,%esi
    330a:	48 8d 3d af 37 00 00 	lea    0x37af(%rip),%rdi        # 6ac0 <_IO_stdin_used@@Base+0xac0> // "Warning: -Z ignored. Requires anx SELinux enabled kernel\n"
    3311:	e8 fa f3 ff ff       	callq  2710 <fwrite@plt>
    3316:	e9 e5 f5 ff ff       	jmpq   2900 <__sprintf_chk@plt+0x190>*/
       
    /*331b:	48 83 7c 24 28 00    	cmpq   $0x0,0x28(%rsp)  (rsp+0x28)=pw
    3321:	0f 84 52 03 00 00    	je     3679 <__sprintf_chk@plt+0xf09>*/
        else if (pw == 0) {
            // je 3679
            fun_4340(find_proc(pid), 0, 1, 1, 1, 0, 0);
        }
        else {

    /*3327:	48 8b 44 24 28       	mov    0x28(%rsp),%rax  // (rsp+0x28)=pw
    332c:	8b 70 10             	mov    0x10(%rax),%esi  // esi=pw->pw_uid
    332f:	48 85 ed             	test   %rbp,%rbp
    3332:	75 18                	jne    334c <__sprintf_chk@plt+0xbdc>
    3334:	eb 1c                	jmp    3352 <__sprintf_chk@plt+0xbe2>
    3336:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    333d:	00 00 00 
            
    3340:	48 8b ad c0 00 00 00 	mov    0xc0(%rbp),%rbp      // gvar_9488->next
    3347:	48 85 ed             	test   %rbp,%rbp
    334a:	74 06                	je     3352 <__sprintf_chk@plt+0xbe2>

    334c:	83 7d 54 01          	cmpl   $0x1,0x54(%rbp)      // gvar_9488->pid ?= 1
    3350:	75 ee                	jne    3340 <__sprintf_chk@plt+0xbd0>*/            

    /*3352:	48 89 ef             	mov    %rbp,%rdi
    3355:	e8 16 1b 00 00       	callq  4e70 <__sprintf_chk@plt+0x2700>*/
            fun_4e70(find_proc(1), pw->pw_uid);

    /*335a:	83 3d d7 60 00 00 00 	cmpl   $0x0,0x60d7(%rip)        # 9438 <stderr@@GLIBC_2.2.5+0x18>   // gvar_9438
    3361:	0f 85 45 fe ff ff    	jne    31ac <__sprintf_chk@plt+0xa3c>
    3367:	ba 05 00 00 00       	mov    $0x5,%edx
    336c:	48 8d 35 01 2f 00 00 	lea    0x2f01(%rip),%rsi        # 6274 <_IO_stdin_used@@Base+0x274> // "No processes found.\n"
    3373:	31 ff                	xor    %edi,%edi
    3375:	41 bf 01 00 00 00    	mov    $0x1,%r15d
    337b:	e8 80 f1 ff ff       	callq  2500 <dcgettext@plt>
    3380:	48 8b 3d 99 60 00 00 	mov    0x6099(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3387:	be 01 00 00 00       	mov    $0x1,%esi
    338c:	48 89 c2             	mov    %rax,%rdx
    338f:	31 c0                	xor    %eax,%eax
    3391:	e8 8a f3 ff ff       	callq  2720 <__fprintf_chk@plt>*/
            if (!gvar_9438) {
                fprintf(stderr, "No processes found.\n");
                return 1;
            }
        }

    /*3396:	e9 e0 f5 ff ff       	jmpq   297b <__sprintf_chk@plt+0x20b> */        // 297b 跳转到此为程序结束

    #if 0
    /* if (gvar_9468 == 0) jump here */
    /*339b:	48 c7 44 24 30 00 00 	movq   $0x0,0x30(%rsp)
    33a2:	00 00 
    33a4:	e9 10 f9 ff ff       	jmpq   2cb9 <__sprintf_chk@plt+0x549>*/
    #endif
    
    #if 0
    /* if (sscanf_ret == 3) jump here */
    /*33a9:	48 8b 84 24 a8 00 00 	mov    0xa8(%rsp),%rax  // rax=proc_stt_jf
    33b0:	00 
    33b1:	bf 02 00 00 00       	mov    $0x2,%edi        // edi=2
    33b6:	48 89 44 24 08       	mov    %rax,0x8(%rsp)   // (rsp+0x8)=rax=proc_stt_jf
    33bb:	e8 30 f3 ff ff       	callq  26f0 <sysconf@plt>*/
            double sc_clk_tck = sysconf(2);

    /*33c0:	66 0f ef d2          	pxor   %xmm2,%xmm2      // xmm2=0
    33c4:	f2 48 0f 2a d0       	cvtsi2sd %rax,%xmm2     // xmm2=sc_clk_tck=100.0，有符号整数变成1个双精度浮点数,结果送入目的寄存器的低64位,高64位不变. v2_double = {100, 0}
    33c9:	66 0f 2f 15 9f 38 00 	comisd 0x389f(%rip),%xmm2        # 6c70 <_IO_stdin_used@@Base+0xc70>
    33d0:	00 
    33d1:	f2 0f 11 54 24 48    	movsd  %xmm2,0x48(%rsp) // (rsp+0x48)=sc_clk_tck=100.0
    33d7:	0f 86 d5 06 00 00    	jbe    3ab2 <__sprintf_chk@plt+0x1342>*/  // not jump
            if (gvar_6c70 <= sc_clk_tck) {
                // jbe 3ab2
                assert(sc_clk_tck > 0);
            }

    /*33dd:	48 8d 35 4c 2f 00 00 	lea    0x2f4c(%rip),%rsi        # 6330 <_IO_stdin_used@@Base+0x330> // "r"
    33e4:	48 8d 3d 06 2e 00 00 	lea    0x2e06(%rip),%rdi        # 61f1 <_IO_stdin_used@@Base+0x1f1> // "/proc/uptime"
    33eb:	e8 e0 f2 ff ff       	callq  26d0 <fopen@plt>*/
            FILE *fp2 = fopen("/proc/uptime", "r");

    /*33f0:	48 85 c0             	test   %rax,%rax
    33f3:	0f 84 92 06 00 00    	je     3a8b <__sprintf_chk@plt+0x131b>*/
            if (fp2 == NULL) {
                // je 3a8b
                perror("pstree: error opening uptime file\n");
                exit(1);
            }

    /*33f9:	48 8d 35 fe 2d 00 00 	lea    0x2dfe(%rip),%rsi        # 61fe <_IO_stdin_used@@Base+0x1fe> // "C"
    3400:	bf 01 00 00 00       	mov    $0x1,%edi                // edi=1
    3405:	48 89 44 24 58       	mov    %rax,0x58(%rsp)          // (rsp+0x58)=fp2
    340a:	e8 91 f2 ff ff       	callq  26a0 <setlocale@plt>*/
                /* #define __LC_NUMERIC             1 */
            char *set_locale = setlocale(__LC_NUMERIC, "C");

    /*340f:	4c 8b 44 24 58       	mov    0x58(%rsp),%r8           // r8=fp2
    3414:	48 8d 35 e5 2d 00 00 	lea    0x2de5(%rip),%rsi        # 6200 <_IO_stdin_used@@Base+0x200> */  // "%2047s"
            char fscanf_buf[2047+1] = {0};

    /*341b:	48 89 44 24 50       	mov    %rax,0x50(%rsp)          // (rsp+0x50)=set_locale
    3420:	48 8d 84 24 f0 27 00 	lea    0x27f0(%rsp),%rax        // rax=fscanf_buf
    3427:	00 
    3428:	48 89 44 24 40       	mov    %rax,0x40(%rsp)          // (rsp+0x40)=&fscanf_buf
    342d:	48 89 c2             	mov    %rax,%rdx                // rdx=&fscanf_buf
    3430:	4c 89 c7             	mov    %r8,%rdi                 // rdi=fp2
    3433:	31 c0                	xor    %eax,%eax
    3435:	e8 16 f0 ff ff       	callq  2450 <__isoc99_fscanf@plt>*/
                if (fscanf(fp2, "%2047s", fscanf_buf) == EOF) {

    /*343a:	4c 8b 44 24 58       	mov    0x58(%rsp),%r8           // r8=fp2
    343f:	83 c0 01             	add    $0x1,%eax                // eax=1
    3442:	0f 84 f9 02 00 00    	je     3741 <__sprintf_chk@plt+0xfd1>*/
                    perror("uptime");
                }

    /*3448:	4c 89 c7             	mov    %r8,%rdi                 // rdi=r8=fp2
    344b:	e8 70 f0 ff ff       	callq  24c0 <fclose@plt>*/
                fclose(fp2);

    /*3450:	48 8b 74 24 50       	mov    0x50(%rsp),%rsi          (rsp+0x50)=set_locale
    3455:	bf 01 00 00 00       	mov    $0x1,%edi
    345a:	e8 41 f2 ff ff       	callq  26a0 <setlocale@plt>*/
                setlocale(__LC_NUMERIC, set_locale);

    /*345f:	48 8b 7c 24 40       	mov    0x40(%rsp),%rdi          // rdi==&fscanf_buf
    3464:	31 f6                	xor    %esi,%esi
    3466:	e8 25 f0 ff ff       	callq  2490 <strtod@plt>*/
                double strtod_ret = strtod(fscanf_buf, NULL);

    /*346b:	48 8b 44 24 08       	mov    0x8(%rsp),%rax           // (rsp+0x8)=proc_stt_jf
    3470:	66 0f 28 c8          	movapd %xmm0,%xmm1              // xmm1=xmm0=strtod_ret
    3474:	48 85 c0             	test   %rax,%rax                // rax=proc_stt_jf
    3477:	0f 88 3a 02 00 00    	js     36b7 <__sprintf_chk@plt+0xf47>*/
                if (proc_stt_jf < 0) {
                    // js 36b7
                }

    /*347d:	66 0f ef c0          	pxor   %xmm0,%xmm0          // xmm0=0.0
    3481:	f2 48 0f 2a c0       	cvtsi2sd %rax,%xmm0         // xmm0=rax=proc_stt_jf=45.0*/

    /*3486:	f2 0f 5e 44 24 48    	divsd  0x48(%rsp),%xmm0     // xmm0=xmm0/(rsp+0x48)=proc_stt_jf/sc_clk_tck=45.0/100.0=0.45
    348c:	f2 0f 5c c8          	subsd  %xmm0,%xmm1          // xmm1=xmm1-xmm0=29524.169999999998-0.45=29523.719999999998
    3490:	66 0f ef db          	pxor   %xmm3,%xmm3*/        // xmm3=0.0
                sc_clk_tck = strtod_ret - proc_stt_jf / sc_clk_tck;
    
    /*3494:	48 8d 45 01          	lea    0x1(%rbp),%rax */    // rax=strchr_ret
                ++strchr_ret;

    /*3498:	83 3d a5 5f 00 00 00 	cmpl   $0x0,0x5fa5(%rip)    # 9444 <stderr@@GLIBC_2.2.5+0x24>*/   // gvar_9444
                if (gvar_9444 == 0)  {  /* handle process threads */
                
    /*349f:	48 89 44 24 08       	mov    %rax,0x8(%rsp)       // (rsp+0x8)=rax=strchr_ret
    34a4:	f2 0f 5f d9          	maxsd  %xmm1,%xmm3          // xmm3=xmm1=strtod_ret=29523.719999999998
    34a8:	f2 0f 11 5c 24 48    	movsd  %xmm3,0x48(%rsp)     // (rsp+0x48)=sc_clk_tck=29523.719999999998
    34ae:	0f 84 26 02 00 00    	je     36da <__sprintf_chk@plt+0xf6a> */  // jump
                    // je 36da  ===>    ac

                }   /* if (gvar_9444 == 0) */
    #endif

#if 0   /* 因编译原因屏蔽 */
    /*34b4:	83 3d ad 5f 00 00 00 	cmpl   $0x0,0x5fad(%rip)        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468    ac
    34bb:	0f 84 d9 00 00 00    	je     359a <__sprintf_chk@plt+0xe2a>*/
                if (gvar_9468 == 0) {   // 1194 ac
                    // je 359a
                    fun_5150(strchr_ret, pid, ppid, pgid, st.st_uid, NULL, 0, 0, sc_clk_tck);
                }
                else if (gvar_9468 != 0) {   /* handle process */
                
    /*34c1:	41 89 d9             	mov    %ebx,%r9d            // r9d=pid
    34c4:	4c 8d 05 00 2d 00 00 	lea    0x2d00(%rip),%r8        # 61cb <_IO_stdin_used@@Base+0x1cb>  // char *gvar_61cb="/proc"
    34cb:	48 83 ca ff          	or     $0xffffffffffffffff,%rdx
    34cf:	31 c0                	xor    %eax,%eax
    34d1:	48 8d 0d 6a 2d 00 00 	lea    0x2d6a(%rip),%rcx        # 6242 <_IO_stdin_used@@Base+0x242> // "%s/%d/cmdline"
    34d8:	be 01 00 00 00       	mov    $0x1,%esi                // esi=1
    34dd:	4c 89 f7             	mov    %r14,%rdi                // r14=path
    34e0:	e8 8b f2 ff ff       	callq  2770 <__sprintf_chk@plt>*/
                    sprintf(path, "%s/%d/cmdline", gvar_61cb, pid);

    /*34e5:	31 f6                	xor    %esi,%esi
    34e7:	4c 89 f7             	mov    %r14,%rdi                // r14=path
    34ea:	31 c0                	xor    %eax,%eax
    34ec:	e8 cf f1 ff ff       	callq  26c0 <open@plt>
    34f1:	89 c5                	mov    %eax,%ebp                // ebp=eax=open_fd
    34f3:	85 c0                	test   %eax,%eax
    34f5:	0f 88 63 02 00 00    	js     375e <__sprintf_chk@plt+0xfee>*/
                    int open_fd = -1;

                    open_fd = open(path, 0);
                    if ( open_fd < 0) {
                        // js 375e  ===> jmpq   2ce0
                        fclose(fp);
                        free(path);
                        continue;
                    }

    /*34fb:	48 8b 54 24 20       	mov    0x20(%rsp),%rdx          // rdx=(rsp+0x20)=buffer_size
    3500:	48 8b 74 24 30       	mov    0x30(%rsp),%rsi          // rsi=(rsp+0x30)=buffer
    3505:	89 c7                	mov    %eax,%edi                // edi=open_fd
    3507:	e8 94 f0 ff ff       	callq  25a0 <read@plt>*/
                    int read_size = -1;

                    read_size = read(open_fd, buffer, buffer_size);
                    if (read_size < 0) {
    /*350c:	85 c0                	test   %eax,%eax
    350e:	0f 88 43 02 00 00    	js     3757 <__sprintf_chk@plt+0xfe7>*/
                        // js 3757  ===> jmpq   2ce0
                        close(open_fd);
                        fclose(fp);
                        free(path);
                        continue;
                    }

    /*3514:	89 ef                	mov    %ebp,%edi            // edi=ebp=open_fd
    3516:	89 44 24 40          	mov    %eax,0x40(%rsp)      // (rsp+0x40)=read_size
    351a:	48 89 44 24 10       	mov    %rax,0x10(%rsp)      // (rsp+0x10)=read_size
    351f:	e8 5c f0 ff ff       	callq  2580 <close@plt>*/
                    close(open_fd);

    /*3524:	48 8b 4c 24 10       	mov    0x10(%rsp),%rcx      // rcx=(rsp+0x10)=read_size
    3529:	3b 4c 24 20          	cmp    0x20(%rsp),%ecx      // ecx=read_size, (rsp+0x20)=buffer_size
    352d:	8b 54 24 40          	mov    0x40(%rsp),%edx      // edx=(rsp+0x40)=read_size
    3531:	7c 03                	jl     3536 <__sprintf_chk@plt+0xdc6>   // 小于(有符号<)
    3533:	8d 51 ff             	lea    -0x1(%rcx),%edx*/    // edx=read_size--
                    if (read_size >= buffer_size) {
                        read_size--;
                    }
    /*3536:	85 d2                	test   %edx,%edx
    3538:	74 0f                	je     3549 <__sprintf_chk@plt+0xdd9>*/
                    if (read_size != 0) {

    /*353a:	48 8b 4c 24 30       	mov    0x30(%rsp),%rcx      // rcx=buffer
    353f:	48 63 c2             	movslq %edx,%rax            // rax=edx=read_size
    3542:	83 c2 01             	add    $0x1,%edx            // edx=read_size++
    3545:	c6 04 01 00          	movb   $0x0,(%rcx,%rax,1)*/   // 
                        buffer[read_size++] = 0;
                    }

    /*3549:	41 50                	push   %r8
    354b:	ff b4 24 a8 00 00 00 	pushq  0xa8(%rsp)           // (rsp+0xa8)=*ptr_strtol   ===> 0xa0(%rsp)
    3552:	6a 00                	pushq  $0x0
    3554:	52                   	push   %rdx                 // rdx=read_size
    3555:	f2 0f 10 44 24 68    	movsd  0x68(%rsp),%xmm0     // xmm0=(rsp+0x68)=sc_clk_tck   ===> 0x48(%rsp)
    355b:	4c 8b 4c 24 50       	mov    0x50(%rsp),%r9       // r9=buffer   ===> 0x30(%rsp)

    3560:	44 8b 84 24 ec 00 00 	mov    0xec(%rsp),%r8d      // r8d=st.st_uid    ===> 0xcc(%rsp)
    3567:	00 
    3568:	8b 8c 24 a4 00 00 00 	mov    0xa4(%rsp),%ecx      // ecx=pgid    ===> 0x84(%rsp)     
    356f:	89 de                	mov    %ebx,%esi            // esi=ebx=pid
    3571:	8b 94 24 a0 00 00 00 	mov    0xa0(%rsp),%edx      // edx=ppid   ===> 0x80(%rsp)
    3578:	48 8b 7c 24 28       	mov    0x28(%rsp),%rdi      // rdi=strchr_ret   ===> 0x8(%rsp)
    357d:	e8 ce 1b 00 00       	callq  5150 <__sprintf_chk@plt+0x29e0>*/      // fun_5150   1223
                    fun_5150(strchr_ret, pid, ppid, pgid, st.st_uid, buffer, read_size, 0, sc_clk_tck);
                }   /* if (gvar_9468 != 0) */

    /*3582:	48 83 c4 20          	add    $0x20,%rsp           // 平衡栈
    3586:	e9 f7 f8 ff ff       	jmpq   2e82 <__sprintf_chk@plt+0x712>*/
                // jmpq 2e82
                /*fclose(fp);
                  }
                free(path);*/

    /*358b:	48 8b 7c 24 30       	mov    0x30(%rsp),%rdi      // rdi=buffer
    3590:	e8 6b ee ff ff       	callq  2400 <free@plt>*/
                free(buffer);

    /*3595:	e9 e2 fa ff ff       	jmpq   307c <__sprintf_chk@plt+0x90c>*/                

    /*359a:	41 51                	push   %r9              // ac
    359c:	45 31 c9             	xor    %r9d,%r9d
    359f:	ff b4 24 a8 00 00 00 	pushq  0xa8(%rsp)       // (rsp+0xa8)=*ptr_strtol   ===> 0xa0(%rsp)
    35a6:	6a 00                	pushq  $0x0
    35a8:	6a 00                	pushq  $0x0
    35aa:	f2 0f 10 44 24 68    	movsd  0x68(%rsp),%xmm0 // xmm0=(rsp+0x68)==sc_clk_tck   ===> 0x48(%rsp)
    35b0:	eb ae                	jmp    3560 <__sprintf_chk@plt+0xdf0>*/

    /*35b2:	48 8d b4 24 90 00 00 	lea    0x90(%rsp),%rsi
    35b9:	00 
    35ba:	ba 0a 00 00 00       	mov    $0xa,%edx
    35bf:	e8 3c f0 ff ff       	callq  2600 <strtol@plt>
    35c4:	89 44 24 3c          	mov    %eax,0x3c(%rsp)      // (rsp+0x3c)=pid
    35c8:	48 8b 84 24 90 00 00 	mov    0x90(%rsp),%rax
    35cf:	00 
    35d0:	80 38 00             	cmpb   $0x0,(%rax)
    35d3:	0f 85 3c f4 ff ff    	jne    2a15 <__sprintf_chk@plt+0x2a5>
    35d9:	c7 44 24 38 01 00 00 	movl   $0x1,0x38(%rsp)      // (rsp+0x38)=pid_set
    35e0:	00 
    35e1:	48 c7 44 24 28 00 00 	movq   $0x0,0x28(%rsp)      // (rsp+0x28)=pw
    35e8:	00 00 
    35ea:	e9 56 f6 ff ff       	jmpq   2c45 <__sprintf_chk@plt+0x4d5>*/
#endif

#if 0
    /*35ef:	8b 44 24 3c          	mov    0x3c(%rsp),%eax      // (rsp+0x3c)=pid
    35f3:	49 89 ec             	mov    %rbp,%r12            // r12=gvar_9488
    35f6:	eb 0d                	jmp    3605 <__sprintf_chk@plt+0xe95>*/

    /*35f8:	4d 8b a4 24 c0 00 00 	mov    0xc0(%r12),%r12      // r12=gvar_9488->next
    35ff:	00 
    3600:	4d 85 e4             	test   %r12,%r12
    3603:	74 67                	je     366c <__sprintf_chk@plt+0xefc>

    3605:	41 3b 44 24 54       	cmp    0x54(%r12),%eax      // eax=gvar_9488->pid           
    360a:	75 ec                	jne    35f8 <__sprintf_chk@plt+0xe88>*/
        child_proc = find_proc(pid);

        if (child_proc != NULL) {
            PROC * parent;                

    /* 封装成函数 ---> trim_tree_by_parent() */
    goto_360c:
    /*360c:	4d 8b ac 24 b8 00 00 	mov    0xb8(%r12),%r13      // r13=parent=child_proc->parent
    3613:	00 
    3614:	4d 85 ed             	test   %r13,%r13
    3617:	74 53                	je     366c <__sprintf_chk@plt+0xefc>*/ // 跳出递归
            parent = child_proc->parent;

            if (parent != NULL) {

    /*3619:	49 8b 9d b0 00 00 00 	mov    0xb0(%r13),%rbx      // rbx=parent->children
    3620:	48 85 db             	test   %rbx,%rbx
    3623:	74 14                	je     3639 <__sprintf_chk@plt+0xec9>
    3625:	0f 1f 00             	nopl   (%rax)*/
                CHILD *walk, *next;
                walk = parent->children;

                while (walk != NULL) {

    /*3628:	48 89 df             	mov    %rbx,%rdi            // rdi=parent->children
    362b:	48 8b 5b 08          	mov    0x8(%rbx),%rbx       // rbx=parent->children->next
    362f:	e8 cc ed ff ff       	callq  2400 <free@plt>
    3634:	48 85 db             	test   %rbx,%rbx            // walk ?= NULL
    3637:	75 ef                	jne    3628 <__sprintf_chk@plt+0xeb8>*/
                    next = walk->next;
                    free(walk);
                    walk = next;
                }

    /*3639:	49 c7 85 b0 00 00 00 	movq   $0x0,0xb0(%r13)      // parent->children = NULL
    3640:	00 00 00 00 
    3644:	4c 89 e6             	mov    %r12,%rsi
    3647:	4c 89 ef             	mov    %r13,%rdi
    364a:	4d 89 ec             	mov    %r13,%r12
    364d:	e8 ce 18 00 00       	callq  4f20 <__sprintf_chk@plt+0x27b0>  // fun_4f20
    3652:	eb b8                	jmp    360c <__sprintf_chk@plt+0xe9c>*/ // 递归调用，直到parent为空跳出
                parent->children = NULL;
                fun_4f20(parent, child_proc);
                goto goto_360c;

    /*3654:	83 3d fd 5d 00 00 00 	cmpl   $0x0,0x5dfd(%rip)        # 9458 <stderr@@GLIBC_2.2.5+0x38>   gvar_9458
    365b:	0f 84 7e fa ff ff    	je     30df <__sprintf_chk@plt+0x96f>   gvar_9458 == 0
    3661:	83 7c 24 38 00       	cmpl   $0x0,0x38(%rsp)                  // (rsp+0x38)=pid_set
    3666:	0f 84 73 fa ff ff    	je     30df <__sprintf_chk@plt+0x96f>   pid_set == 0 */
            }   /* if (parent != NULL) */
        }   /* if (child_proc != NULL) */

    /*366c:	c7 44 24 3c 01 00 00 	movl   $0x1,0x3c(%rsp)      // (rsp+0x3c)=pid=1
    3673:	00 
    3674:	e9 66 fa ff ff       	jmpq   30df <__sprintf_chk@plt+0x96f>*/ // 接 if(show_parents && pid_set == 1) 执行之后
#endif

    /*3679:	8b 44 24 3c          	mov    0x3c(%rsp),%eax      // (rsp+0x3c)=pid
    367d:	eb 0c                	jmp    368b <__sprintf_chk@plt+0xf1b>
    367f:	3b 45 54             	cmp    0x54(%rbp),%eax      // ->pid ?= pid
    3682:	74 0c                	je     3690 <__sprintf_chk@plt+0xf20>
    3684:	48 8b ad c0 00 00 00 	mov    0xc0(%rbp),%rbp      // rbp=->next
    368b:	48 85 ed             	test   %rbp,%rbp
    368e:	75 ef                	jne    367f <__sprintf_chk@plt+0xf0f>
    3690:	50                   	push   %rax
    3691:	b9 01 00 00 00       	mov    $0x1,%ecx            // ecx=1
    3696:	ba 01 00 00 00       	mov    $0x1,%edx            // edx=1
    369b:	45 31 c9             	xor    %r9d,%r9d            // r9d=0
    369e:	6a 00                	pushq  $0x0
    36a0:	41 b8 01 00 00 00    	mov    $0x1,%r8d            // r8d=1
    36a6:	31 f6                	xor    %esi,%esi            // esi=0
    36a8:	48 89 ef             	mov    %rbp,%rdi            // rdi=->next
    36ab:	e8 90 0c 00 00       	callq  4340 <__sprintf_chk@plt+0x1bd0>  // fun_4340
    36b0:	5a                   	pop    %rdx
    36b1:	59                   	pop    %rcx
    36b2:	e9 f5 fa ff ff       	jmpq   31ac <__sprintf_chk@plt+0xa3c>*/

    /*36b7:	48 8b 4c 24 08       	mov    0x8(%rsp),%rcx   // (rsp+0x8)=proc_stt_jf=81
    36bc:	66 0f ef c0          	pxor   %xmm0,%xmm0      // xmm0 = 0
    36c0:	48 89 c8             	mov    %rcx,%rax        // rax=81
    36c3:	83 e1 01             	and    $0x1,%ecx        // ecx=1
    36c6:	48 d1 e8             	shr    %rax             // rax=0x81>>1=40=0x28
    36c9:	48 09 c8             	or     %rcx,%rax        // rax=0x28|1 =41=0x29
    36cc:	f2 48 0f 2a c0       	cvtsi2sd %rax,%xmm0     // xmm0=rax
    36d1:	f2 0f 58 c0          	addsd  %xmm0,%xmm0      // strtod_ret=xmm0
    36d5:	e9 ac fd ff ff       	jmpq   3486 <__sprintf_chk@plt+0xd16>*/

    #if 0
    /* if (gvar_9444 == 0)  jump here */
    /*36da:	31 c0                	xor    %eax,%eax
    36dc:	4c 89 f7             	mov    %r14,%rdi        // r14=path="/proc/1"
    36df:	48 83 c9 ff          	or     $0xffffffffffffffff,%rcx // rcx=-1
    36e3:	f2 ae                	repnz scas %es:(%rdi),%al
    36e5:	48 89 c8             	mov    %rcx,%rax            // 0xfffffffffffffff7
    36e8:	48 f7 d0             	not    %rax                 // rax=0x8
    36eb:	48 8d 78 09          	lea    0x9(%rax),%rdi       // rdi=8+9=17
    36ef:	e8 4c ef ff ff       	callq  2640 <malloc@plt>
    36f4:	48 89 44 24 50       	mov    %rax,0x50(%rsp)*/    // *taskpath
            char *taskpath = (char *)malloc(strlen(path) + 0xa);

    /*36f9:	48 89 c5             	mov    %rax,%rbp        // rbp=*taskpath
    36fc:	48 85 c0             	test   %rax,%rax
    36ff:	0f 84 16 03 00 00    	je     3a1b <__sprintf_chk@plt+0x12ab>*/
             if (taskpath == NULL) {
                // je 3a1b
                exit(2);
             }

    /*3705:	48 89 c7             	mov    %rax,%rdi        // rdi=*taskpath
    3708:	4d 89 f0             	mov    %r14,%r8         r14=path
    370b:	48 8d 0d f5 2a 00 00 	lea    0x2af5(%rip),%rcx        # 6207 <_IO_stdin_used@@Base+0x207> // "%s/task"
    3712:	31 c0                	xor    %eax,%eax
    3714:	48 83 ca ff          	or     $0xffffffffffffffff,%rdx
    3718:	be 01 00 00 00       	mov    $0x1,%esi
    371d:	e8 4e f0 ff ff       	callq  2770 <__sprintf_chk@plt>*/
             sprintf(taskpath, "%s/task", path);
             printf("taskpath=%s\n", taskpath);

    /*3722:	48 89 ef             	mov    %rbp,%rdi            // rdi=rbp=*taskpath
    3725:	e8 a6 ed ff ff       	callq  24d0 <opendir@plt>
    372a:	48 89 c5             	mov    %rax,%rbp            // rbp=rax=*dirptr
    372d:	48 85 c0             	test   %rax,%rax*/
            DIR *dirptr = opendir(taskpath);
            if (dirptr != NULL) {
                // jne 3773  ===>   ac

            }   /* if (dirptr != NULL) */

    /*3730:	75 41                	jne    3773 <__sprintf_chk@plt+0x1003>      // ac
    3732:	48 8b 7c 24 50       	mov    0x50(%rsp),%rdi      // rdi=*taskpath
    3737:	e8 c4 ec ff ff       	callq  2400 <free@plt>*/
            free(taskpath);

    /*373c:	e9 73 fd ff ff       	jmpq   34b4 <__sprintf_chk@plt+0xd44>*/     // ac
    #endif

    #if 0
    /*3741:	48 8d 3d af 2a 00 00 	lea    0x2aaf(%rip),%rdi        # 61f7 <_IO_stdin_used@@Base+0x1f7>
    3748:	e8 93 ef ff ff       	callq  26e0 <perror@plt>
    374d:	4c 8b 44 24 58       	mov    0x58(%rsp),%r8           // (rsp+0x58)=fp2
    3752:	e9 f1 fc ff ff       	jmpq   3448 <__sprintf_chk@plt+0xcd8>*/
        perror("uptime");

    /*3757:	89 ef                	mov    %ebp,%edi
    3759:	e8 22 ee ff ff       	callq  2580 <close@plt>*/
    #endif

    /*375e:	4c 89 ef             	mov    %r13,%rdi
    3761:	e8 5a ed ff ff       	callq  24c0 <fclose@plt>
    3766:	4c 89 f7             	mov    %r14,%rdi
    3769:	e8 92 ec ff ff       	callq  2400 <free@plt>
    376e:	e9 6d f5 ff ff       	jmpq   2ce0 <__sprintf_chk@plt+0x570>*/ // 2ce0=while ((dp = readdir(pdir)) != NULL) {
    
    #if 0
    /* if (dirptr != NULL) jump here */
    /*3773:	4c 89 64 24 68       	mov    %r12,0x68(%rsp)      // r12=pdir
    3778:	4c 89 6c 24 70       	mov    %r13,0x70(%rsp)      // r13=fp
    377d:	48 89 ef             	mov    %rbp,%rdi            // rdi=rbp=*dirptr
    3780:	e8 ab ee ff ff       	callq  2630 <readdir@plt>
    3785:	48 85 c0             	test   %rax,%rax*/          // rax=p_dirent
            struct dirent *p_dirent;
            while ((p_dirent = readdir(dirptr)) != NULL) {

    /*3788:	0f 84 ef 01 00 00    	je     397d <__sprintf_chk@plt+0x120d> // break  ac
    378e:	48 8d 78 13          	lea    0x13(%rax),%rdi  // rdi=p_dirent->name
    3792:	ba 0a 00 00 00       	mov    $0xa,%edx        // edx=10
    3797:	31 f6                	xor    %esi,%esi        // esi=0
    3799:	e8 62 ee ff ff       	callq  2600 <strtol@plt>*/
                char *ptrnull = NULL;
                int thread = strtol(p_dirent->d_name, &ptrnull, 10);

    /*379e:	41 89 c5             	mov    %eax,%r13d           // r13d=thread
    37a1:	39 44 24 10          	cmp    %eax,0x10(%rsp)      // (rsp+0x10)=pid
    37a5:	74 d6                	je     377d <__sprintf_chk@plt+0x100d>
    37a7:	85 c0                	test   %eax,%eax
    37a9:	74 d2                	je     377d <__sprintf_chk@plt+0x100d>*/
                if ((thread == pid) || (thread == 0)) {
                    continue;
                }

    /*37ab:	bf 43 00 00 00       	mov    $0x43,%edi           // edi=0x43=67=C
    37b0:	48 89 44 24 58       	mov    %rax,0x58(%rsp)*/    // rsp+0x58=thread

    /*37b5:	e8 86 ee ff ff       	callq  2640 <malloc@plt>
    37ba:	49 89 c4             	mov    %rax,%r12*/          // r12=malloc return=threadname
                char *threadname = malloc(0x43);

    /*37bd:	48 85 c0             	test   %rax,%rax
    37c0:	0f 84 55 02 00 00    	je     3a1b <__sprintf_chk@plt+0x12ab>*/            
                if (threadname == NULL) {
                    exit(2);
                }

    /*37c6:	83 3d 7b 5c 00 00 00 	cmpl   $0x0,0x5c7b(%rip)        # 9448 <stderr@@GLIBC_2.2.5+0x28>   // gvar_9448
    37cd:	4c 8b 54 24 58       	mov    0x58(%rsp),%r10          // (rsp+0x58)=thread， 0x7fffffff9a18: 0x000000000000059d
    37d2:	0f 84 1d 01 00 00    	je     38f5 <__sprintf_chk@plt+0x1185>*/
                if (gvar_9448 != 0) {

    /*37d8:	41 52                	push   %r10                 // r10=0x1e0
    37da:	8b 44 24 18          	mov    0x18(%rsp),%eax      // eax=0x1df
    37de:	4c 8d 0d e6 29 00 00 	lea    0x29e6(%rip),%r9        # 61cb <_IO_stdin_used@@Base+0x1cb>  // char *gvar_61cb="/proc"
    37e5:	31 f6                	xor    %esi,%esi
    37e7:	4c 8d 05 28 2a 00 00 	lea    0x2a28(%rip),%r8        # 6216 <_IO_stdin_used@@Base+0x216>  // "%s/%d/task/%d/stat"
    37ee:	48 83 c9 ff          	or     $0xffffffffffffffff,%rcx // rcx=-1
    37f2:	ba 01 00 00 00       	mov    $0x1,%edx            // edx=1
    37f7:	31 ff                	xor    %edi,%edi            // edi=0
    37f9:	4c 89 94 24 80 00 00 	mov    %r10,0x80(%rsp)      // (rsp+0x80)=r10=thread    0x80(%rsp)=0x7fffffff9a38:0x000000000000059d
    3800:	00 
    3801:	50                   	push   %rax                 // rax=0x1df
    3802:	31 c0                	xor    %eax,%eax            // eax=0
    3804:	e8 e7 eb ff ff       	callq  23f0 <__snprintf_chk@plt>*/
                    int stat_len = snprintf(NULL, 0, "%s/%d/task/%d/stat", gvar_61cb, pid, thread);

    /*3809:	48 63 f0             	movslq %eax,%rsi            // rsi=eax=stat_len           
    380c:	48 83 c6 01          	add    $0x1,%rsi */         // rsi=stat_len+1
                    stat_len++;

    /*3810:	48 89 f7             	mov    %rsi,%rdi            // rdi=stat_len
    3813:	48 89 74 24 70       	mov    %rsi,0x70(%rsp)      // (rsp+0x70)=stat_len
    3818:	e8 23 ee ff ff       	callq  2640 <malloc@plt>
    381d:	48 89 44 24 68       	mov    %rax,0x68(%rsp)*/    // (rsp+0x68)=rax=stat_path
                    char *stat_path = malloc(stat_len);

    /*3822:	48 89 c7             	mov    %rax,%rdi            // rdi=rax=stat_path
    3825:	41 58                	pop    %r8                  // r8=push rax=0x1df
    3827:	41 59                	pop    %r9                  // r9=push r10=0x1e0
    3829:	48 85 c0             	test   %rax,%rax
    382c:	0f 84 e9 01 00 00    	je     3a1b <__sprintf_chk@plt+0x12ab>*/
                    if (stat_path == NULL) {
                        exit(2);              
                    }
                                                                // 因一个push，两个pop所致
    /*3832:	4c 8b 54 24 78       	mov    0x78(%rsp),%r10*/    // 0x78(%rsp) = (rsp+0x80) = 0x7fffffff9a38:0x000000000000059d = thread

    /*3837:	4c 8d 0d 8d 29 00 00 	lea    0x298d(%rip),%r9        # 61cb <_IO_stdin_used@@Base+0x1cb>  // char *gvar_61cb="/proc"
    383e:	4c 8d 05 d1 29 00 00 	lea    0x29d1(%rip),%r8        # 6216 <_IO_stdin_used@@Base+0x216>  // "%s/%d/task/%d/stat"
    3845:	48 83 c9 ff          	or     $0xffffffffffffffff,%rcx
    3849:	ba 01 00 00 00       	mov    $0x1,%edx
    384e:	41 52                	push   %r10
    3850:	8b 44 24 18          	mov    0x18(%rsp),%eax
    3854:	50                   	push   %rax                     // rax=malloc return value=stat_path
    3855:	48 8b 74 24 70       	mov    0x70(%rsp),%rsi          // rsi=stat_len
    385a:	31 c0                	xor    %eax,%eax
    385c:	e8 8f eb ff ff       	callq  23f0 <__snprintf_chk@plt>*/
                    int nbytes = snprintf(stat_path, stat_len, "%s/%d/task/%d/stat",  gvar_61cb, pid, thread);

    /*3861:	5e                   	pop    %rsi                     // rsi=push rax=0x1df
    3862:	5f                   	pop    %rdi                     // rdi=push r10=0x1e0
    3863:	48 8b 74 24 60       	mov    0x60(%rsp),%rsi*/        // 因pop的原因，0x60(%rsp)与0x70(%rsp)指向同一个地址，stat_len

    /*3868:	48 98                	cltq   
    386a:	48 39 c6             	cmp    %rax,%rsi                // rax=nbytes, rsi=stat_len
    386d:	77 0c                	ja     387b <__sprintf_chk@plt+0x110b>*/
                    if (nbytes < 0 || nbytes >= stat_len) 

    /*386f:	48 8d 3d b3 29 00 00 	lea    0x29b3(%rip),%rdi        # 6229 <_IO_stdin_used@@Base+0x229> // "get_threadname: snprintf"
    3876:	e8 65 ee ff ff       	callq  26e0 <perror@plt>*/
                        perror("get_threadname: snprintf");

    /*387b:	48 8b 7c 24 58       	mov    0x58(%rsp),%rdi          // rdi=(rsp+0x58)=stat_path, 因两个pop的原因, (rsp+0x68)
    3880:	48 8d 35 a9 2a 00 00 	lea    0x2aa9(%rip),%rsi        # 6330 <_IO_stdin_used@@Base+0x330>
    3887:	e8 44 ee ff ff       	callq  26d0 <fopen@plt>
    388c:	48 89 44 24 60       	mov    %rax,0x60(%rsp)          // (rsp+0x60)=*stat_file
    3891:	48 85 c0             	test   %rax,%rax
    3894:	74 55                	je     38eb <__sprintf_chk@plt+0x117b>*/
                    FILE *stat_file = NULL;
                    char stat_readbuf[0x2000] = {0};
                    char *stat_strchr = NULL, *stat_strrchr = NULL;
                    if ((stat_file = fopen(stat_path, "r")) != NULL) {

    /*3896:	48 8b 7c 24 40       	mov    0x40(%rsp),%rdi          // rdi=(rsp+0x40)=stat_readbuf
    389b:	48 89 c2             	mov    %rax,%rdx                // rdx=stat_file
    389e:	be 00 20 00 00       	mov    $0x2000,%esi             // esi=0x2000
    38a3:	e8 08 ed ff ff       	callq  25b0 <fgets@plt>
    38a8:	48 85 c0             	test   %rax,%rax
    38ab:	74 34                	je     38e1 <__sprintf_chk@plt+0x1171>*/
                        if (fgets(stat_readbuf, 0x2000, stat_file) != NULL) {
                        
    /*38ad:	48 8b 7c 24 40       	mov    0x40(%rsp),%rdi          // rdi=(rsp+0x40)=stat_readbuf
    38b2:	be 28 00 00 00       	mov    $0x28,%esi               // esi='('
    38b7:	e8 84 ec ff ff       	callq  2540 <strchr@plt>*/
                            stat_strchr = strchr(stat_readbuf, '(');
                            stat_strrchr = strrchr(stat_strchr, ')');

    /*38bc:	48 85 c0             	test   %rax,%rax
    38bf:	74 20                	je     38e1 <__sprintf_chk@plt+0x1171>
    38c1:	be 29 00 00 00       	mov    $0x29,%esi               // esi=')'
    38c6:	48 89 c7             	mov    %rax,%rdi                // rdi=stat_strchr
    38c9:	48 89 44 24 78       	mov    %rax,0x78(%rsp)          // (rsp+0x78)=stat_strchr
    38ce:	e8 7d ec ff ff       	callq  2550 <strrchr@plt>
    38d3:	4c 8b 4c 24 78       	mov    0x78(%rsp),%r9           // r9=stat_strchr
    38d8:	48 85 c0             	test   %rax,%rax                // rax=stat_strrchr
    38db:	0f 85 e7 00 00 00    	jne    39c8 <+0x1258>*/
                            if (stat_strchr && stat_strrchr) {
                                // jne 39c8 ===>
                                *stat_strrchr = '\0';
                                ++stat_strchr;
                                sprintf(threadname, "{%.*s}", 0x43, stat_strchr);
                                fclose(stat_file);
                                free(stat_path);
                                // jmpq 391b ===>
                            }

                         }  /* if (fgets(stat_readbuf, 0x2000, stat_file) != NULL) */

    /*38e1:	48 8b 7c 24 60       	mov    0x60(%r__sprintf_chk@pltsp),%rdi     // rdi=stat_file
    38e6:	e8 d5 eb ff ff       	callq  24c0 <fclose@plt>*/
                         fclose(stat_file);

                    }   /* if ((stat_file = fopen(stat_path, "r")) != NULL) */

    /*38eb:	48 8b 7c 24 58       	mov    0x58(%rsp),%rdi          // (rsp+0x58)=stat_path
    38f0:	e8 0b eb ff ff       	callq  2400 <free@plt>*/
                    free(stat_path);

                }   /* if (gvar_9448 != 0) */
                else if (gvar_9448 == 0) {

    /*38f5:	4c 8b 4c 24 08       	mov    0x8(%rsp),%r9            // r9=(rsp+0x8)=strchr_ret
    38fa:	41 b8 40 00 00 00    	mov    $0x40,%r8d               // r8d=0x40
    3900:	4c 89 e7             	mov    %r12,%rdi                // rdi=r12=threadname
    3903:	31 c0                	xor    %eax,%eax
    3905:	48 8d 0d 03 29 00 00 	lea    0x2903(%rip),%rcx        # 620f <_IO_stdin_used@@Base+0x20f> // "{%.*s}"
    390c:	ba 43 00 00 00       	mov    $0x43,%edx
    3911:	be 01 00 00 00       	mov    $0x1,%esi
    3916:	e8 55 ee ff ff       	callq  2770 <__sprintf_chk@plt>*/
                    sprintf(threadname, "{%.*s}", 0x43, strchr_ret);           // r12=threadname
                }

    /*391b:	83 3d 46 5b 00 00 00 	cmpl   $0x0,0x5b46(%rip)        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468
    3922:	48 8b 94 24 a0 00 00 	mov    0xa0(%rsp),%rdx          // rdx=(rsp+0xa0)=*ptr_strtol
    3929:	00 
    392a:	44 8b 84 24 cc 00 00 	mov    0xcc(%rsp),%r8d          // r8d=st.st_uid, 0xb0(%rsp)=st, 0xb0+8+8+4+8=0xcc (command/__xstat.c)
    3931:	00 
    3932:	44 8b 94 24 84 00 00 	mov    0x84(%rsp),%r10d         // (rsp+0x84)=pgid
    3939:	00 
    393a:	74 58                	je     3994 <__sprintf_chk@plt+0x1224>*/
                if (gvar_9468 == 0) {   // 1180
                    // je 3994  ===> jmp 395a
                    fun_5150(threadname, thread, pid, pgid, st.st_uid, NULL, 0, 1, sc_clk_tck);
                }
                else {                
    /*393c:	31 c0                	xor    %eax,%eax
    393e:	48 83 c9 ff          	or     $0xffffffffffffffff,%rcx
    3942:	4c 89 e7             	mov    %r12,%rdi                // rdi=r12=threadname
    3945:	4d 89 e1             	mov    %r12,%r9                 // r9=r12=threadname
    3948:	f2 ae                	repnz scas %es:(%rdi),%al       // 串扫描，把AL或AX的内容与目标串作比较,比较结果反映在标志位
    394a:	48 89 c8             	mov    %rcx,%rax                // rax=strlen(threadname)
    394d:	51                   	push   %rcx
    394e:	f7 d0                	not    %eax                     // eax=strlen(threadname)
    3950:	52                   	push   %rdx
    3951:	6a 01                	pushq  $0x1                     // 0x1
    3953:	50                   	push   %rax                     // strlen(threadname)
    3954:	f2 0f 10 44 24 68    	movsd  0x68(%rsp),%xmm0*/       // xmm0=sc_clk_tck

    /*395a:	8b 54 24 30          	mov    0x30(%rsp),%edx      // edx=pid ，因四个push有0x20的偏移，实际为(rsp+0x10)
    395e:	4c 89 e7             	mov    %r12,%rdi            // rdi=r12=threadname
    3961:	44 89 d1             	mov    %r10d,%ecx           // ecx==pgid
    3964:	44 89 ee             	mov    %r13d,%esi           // r13d=thread
    3967:	e8 e4 17 00 00       	callq  5150 <__sprintf_chk@plt+0x29e0>*/      // fun_5150   1176
                    fun_5150(threadname, thread, pid, pgid, st.st_uid, threadname, strlen(threadname) + 1, 1, sc_clk_tck);
                }   /* if (gvar_9468 == 0) */

    /*396c:	48 83 c4 20          	add    $0x20,%rsp           // 平衡栈
    3970:	4c 89 e7             	mov    %r12,%rdi            // rdi=r12=threadname
    3973:	e8 88 ea ff ff       	callq  2400 <free@plt>*/
                free(threadname);

    /*3978:	e9 00 fe ff ff       	jmpq   377d <__sprintf_chk@plt+0x100d>*/
            }   /* while ((p_dirent = readdir(dirptr)) != NULL)  end */
    #endif

    #if 0
    /*397d:	48 89 ef             	mov    %rbp,%rdi                // rdi=rbp=*dirptr      // ac
    3980:	4c 8b 64 24 68       	mov    0x68(%rsp),%r12          // r12=pdir
    3985:	4c 8b 6c 24 70       	mov    0x70(%rsp),%r13          // r13=fp
    398a:	e8 01 ec ff ff       	callq  2590 <closedir@plt>
    398f:	e9 9e fd ff ff       	jmpq   3732 <__sprintf_chk@plt+0xfc2>*/
            closedir(dirptr);
    #endif 

    /*3994:	45 31 c9             	xor    %r9d,%r9d
    3997:	41 53                	push   %r11
    3999:	52                   	push   %rdx
    399a:	6a 01                	pushq  $0x1                 // 0x1
    399c:	6a 00                	pushq  $0x0                 // 0x0
    399e:	f2 0f 10 44 24 68    	movsd  0x68(%rsp),%xmm0     // sc_clk_tck
    39a4:	eb b4                	jmp    395a <__sprintf_chk@plt+0x11ea>*/

    #if 0
    /*39a6:	ba 05 00 00 00       	mov    $0x5,%edx
    39ab:	48 8d 35 d9 27 00 00 	lea    0x27d9(%rip),%rsi        # 618b <_IO_stdin_used@@Base+0x18b> // "TERM is not set\n"
    39b2:	e9 bc f9 ff ff       	jmpq   3373 <__sprintf_chk@plt+0xc03>*/
            fprintf(stderr, "%s", "TERM is not set\n");

    /*39b7:	ba 05 00 00 00       	mov    $0x5,%edx
    39bc:	48 8d 35 a5 30 00 00 	lea    0x30a5(%rip),%rsi        # 6a68 <_IO_stdin_used@@Base+0xa68> // "Can't get terminal capabilities\n"
    39c3:	e9 ab f9 ff ff       	jmpq   3373 <__sprintf_chk@plt+0xc03>*/
            fprintf(stderr, "%s", "Can't get terminal capabilities\n");
    #endif

    #if 0
    /*39c8:	c6 00 00             	movb   $0x0,(%rax)              // *stat_strrchr=0
    39cb:	49 83 c1 01          	add    $0x1,%r9                 // stat_strchr+1
    39cf:	41 b8 40 00 00 00    	mov    $0x40,%r8d               // r8d=0x40
    39d5:	4c 89 e7             	mov    %r12,%rdi                // rdi=r12=threadname
    39d8:	48 8d 0d 30 28 00 00 	lea    0x2830(%rip),%rcx        # 620f <_IO_stdin_used@@Base+0x20f> // "{%.*s}"
    39df:	ba 43 00 00 00       	mov    $0x43,%edx               // edx=0x43
    39e4:	be 01 00 00 00       	mov    $0x1,%esi                // esi=0x1
    39e9:	31 c0                	xor    %eax,%eax                // eax=0
    39eb:	e8 80 ed ff ff       	callq  2770 <__sprintf_chk@plt>
    39f0:	48 8b 7c 24 60       	mov    0x60(%rsp),%rdi          // (rsp+0x60)=stat_file
    39f5:	e8 c6 ea ff ff       	callq  24c0 <fclose@plt>        // fclose(stat_file)
    39fa:	48 8b 7c 24 58       	mov    0x58(%rsp),%rdi          // (rsp+0x58)=stat_path
    39ff:	e8 fc e9 ff ff       	callq  2400 <free@plt>          // free(stat_path)
    3a04:	e9 12 ff ff ff       	jmpq   391b <__sprintf_chk@plt+0x11ab>*/
    #endif

    #if 0
    /*3a09:	4c 89 f7             	mov    %r14,%rdi
    3a0c:	e8 cf ec ff ff       	callq  26e0 <perror@plt>
    3a11:	bf 01 00 00 00       	mov    $0x1,%edi
    3a16:	e8 e5 ec ff ff       	callq  2700 <exit@plt>*/
        perror("error");
        exit(1);

    /*3a1b:	bf 02 00 00 00       	mov    $0x2,%edi
    3a20:	e8 db ec ff ff       	callq  2700 <exit@plt>*/
        exit(2);

    /*3a25:	48 8d 3d 9f 27 00 00 	lea    0x279f(%rip),%rdi        # 61cb <_IO_stdin_used@@Base+0x1cb> // char *gvar_61cb="/proc"
    3a2c:	e8 af ec ff ff       	callq  26e0 <perror@plt>
    3a31:	bf 01 00 00 00       	mov    $0x1,%edi
    3a36:	e8 c5 ec ff ff       	callq  2700 <exit@plt>*/
        perror();
        exit(1);

    /*3a3b:	48 8d 3d 94 26 00 00 	lea    0x2694(%rip),%rdi        # 60d6 <_IO_stdin_used@@Base+0xd6>
    3a42:	e8 99 ec ff ff       	callq  26e0 <perror@plt>
    3a47:	bf 01 00 00 00       	mov    $0x1,%edi
    3a4c:	e8 af ec ff ff       	callq  2700 <exit@plt>*/
        perror();
        exit(1);
    #endif

    #if 0
    /*3a51:	ba 05 00 00 00       	mov    $0x5,%edx
    3a56:	48 8d 35 f3 27 00 00 	lea    0x27f3(%rip),%rsi        # 6250 <_IO_stdin_used@@Base+0x250> // "%s is empty (not mounted ?)\n"
    3a5d:	31 ff                	xor    %edi,%edi
    3a5f:	e8 9c ea ff ff       	callq  2500 <dcgettext@plt>
    3a64:	48 8b 3d b5 59 00 00 	mov    0x59b5(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3a6b:	be 01 00 00 00       	mov    $0x1,%esi
    3a70:	48 8d 0d 54 27 00 00 	lea    0x2754(%rip),%rcx        # 61cb <_IO_stdin_used@@Base+0x1cb> // char *gvar_61cb="/proc"
    3a77:	48 89 c2             	mov    %rax,%rdx
    3a7a:	31 c0                	xor    %eax,%eax
    3a7c:	e8 9f ec ff ff       	callq  2720 <__fprintf_chk@plt>
    3a81:	bf 01 00 00 00       	mov    $0x1,%edi
    3a86:	e8 75 ec ff ff       	callq  2700 <exit@plt>*/
    
    /*3a8b:	48 8b 0d 8e 59 00 00 	mov    0x598e(%rip),%rcx        # 9420 <stderr@@GLIBC_2.2.5>
    3a92:	ba 22 00 00 00       	mov    $0x22,%edx
    3a97:	be 01 00 00 00       	mov    $0x1,%esi
    3a9c:	48 8d 3d ad 30 00 00 	lea    0x30ad(%rip),%rdi        # 6b50 <_IO_stdin_used@@Base+0xb50> // "pstree: error opening uptime file\n"
    3aa3:	e8 68 ec ff ff       	callq  2710 <fwrite@plt>
    3aa8:	bf 01 00 00 00       	mov    $0x1,%edi
    3aad:	e8 4e ec ff ff       	callq  2700 <exit@plt>*/
    
    /*3ab2:	48 8d 0d a7 31 00 00 	lea    0x31a7(%rip),%rcx        # 6c60 <_IO_stdin_used@@Base+0xc60> // "process_age"
    3ab9:	ba 9e 03 00 00       	mov    $0x39e,%edx
    3abe:	48 8d 35 2d 26 00 00 	lea    0x262d(%rip),%rsi        # 60f2 <_IO_stdin_used@@Base+0xf2>      // "src/pstree.c"
    3ac5:	48 8d 3d 16 27 00 00 	lea    0x2716(%rip),%rdi        # 61e2 <_IO_stdin_used@@Base+0x1e2>     // "sc_clk_tck > 0"
    3acc:	e8 8f ea ff ff       	callq  2560 <__assert_fail@plt>
    3ad1:	e8 4a ea ff ff       	callq  2520 <__stack_chk_fail@plt>
    3ad6:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    3add:	00 00 00 */
        assert(sc_clk_tck > 0);
    #endif

	return 0;
}

    /*3ae0:	f3 0f 1e fa          	endbr64 
    3ae4:	31 ed                	xor    %ebp,%ebp
    3ae6:	49 89 d1             	mov    %rdx,%r9
    3ae9:	5e                   	pop    %rsi
    3aea:	48 89 e2             	mov    %rsp,%rdx
    3aed:	48 83 e4 f0          	and    $0xfffffffffffffff0,%rsp
    3af1:	50                   	push   %rax
    3af2:	54                   	push   %rsp
    3af3:	4c 8d 05 66 1a 00 00 	lea    0x1a66(%rip),%r8        # 5560 <__sprintf_chk@plt+0x2df0>
    3afa:	48 8d 0d ef 19 00 00 	lea    0x19ef(%rip),%rcx        # 54f0 <__sprintf_chk@plt+0x2d80>
    3b01:	48 8d 3d 78 ec ff ff 	lea    -0x1388(%rip),%rdi        # 2780 <__sprintf_chk@plt+0x10>
    3b08:	ff 15 d2 54 00 00    	callq  *0x54d2(%rip)        # 8fe0 <__libc_start_main@GLIBC_2.2.5>
    3b0e:	f4                   	hlt    
    3b0f:	90                   	nop
    3b10:	48 8d 3d b9 58 00 00 	lea    0x58b9(%rip),%rdi        # 93d0 <age_to_color@@Base+0xf0>
    3b17:	48 8d 05 b2 58 00 00 	lea    0x58b2(%rip),%rax        # 93d0 <age_to_color@@Base+0xf0>
    3b1e:	48 39 f8             	cmp    %rdi,%rax
    3b21:	74 15                	je     3b38 <__sprintf_chk@plt+0x13c8>
    3b23:	48 8b 05 ae 54 00 00 	mov    0x54ae(%rip),%rax        # 8fd8 <_ITM_deregisterTMCloneTable>
    3b2a:	48 85 c0             	test   %rax,%rax
    3b2d:	74 09                	je     3b38 <__sprintf_chk@plt+0x13c8>
    3b2f:	ff e0                	jmpq   *%rax
    3b31:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    3b38:	c3                   	retq   
    3b39:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    3b40:	48 8d 3d 89 58 00 00 	lea    0x5889(%rip),%rdi        # 93d0 <age_to_color@@Base+0xf0>
    3b47:	48 8d 35 82 58 00 00 	lea    0x5882(%rip),%rsi        # 93d0 <age_to_color@@Base+0xf0>
    3b4e:	48 29 fe             	sub    %rdi,%rsi
    3b51:	48 89 f0             	mov    %rsi,%rax
    3b54:	48 c1 ee 3f          	shr    $0x3f,%rsi
    3b58:	48 c1 f8 03          	sar    $0x3,%rax
    3b5c:	48 01 c6             	add    %rax,%rsi
    3b5f:	48 d1 fe             	sar    %rsi
    3b62:	74 14                	je     3b78 <__sprintf_chk@plt+0x1408>
    3b64:	48 8b 05 85 54 00 00 	mov    0x5485(%rip),%rax        # 8ff0 <_ITM_registerTMCloneTable>
    3b6b:	48 85 c0             	test   %rax,%rax
    3b6e:	74 08                	je     3b78 <__sprintf_chk@plt+0x1408>
    3b70:	ff e0                	jmpq   *%rax
    3b72:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
    3b78:	c3                   	retq   
    3b79:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    3b80:	f3 0f 1e fa          	endbr64 
    3b84:	80 3d 9d 58 00 00 00 	cmpb   $0x0,0x589d(%rip)        # 9428 <stderr@@GLIBC_2.2.5+0x8>
    3b8b:	75 2b                	jne    3bb8 <__sprintf_chk@plt+0x1448>
    3b8d:	55                   	push   %rbp
    3b8e:	48 83 3d 62 54 00 00 	cmpq   $0x0,0x5462(%rip)        # 8ff8 <__cxa_finalize@GLIBC_2.2.5>
    3b95:	00 
    3b96:	48 89 e5             	mov    %rsp,%rbp
    3b99:	74 0c                	je     3ba7 <__sprintf_chk@plt+0x1437>
    3b9b:	48 8b 3d 66 54 00 00 	mov    0x5466(%rip),%rdi        # 9008 <_IO_stdin_used@@Base+0x3008>
    3ba2:	e8 29 e8 ff ff       	callq  23d0 <__cxa_finalize@plt>
    3ba7:	e8 64 ff ff ff       	callq  3b10 <__sprintf_chk@plt+0x13a0>
    3bac:	c6 05 75 58 00 00 01 	movb   $0x1,0x5875(%rip)        # 9428 <stderr@@GLIBC_2.2.5+0x8>
    3bb3:	5d                   	pop    %rbp
    3bb4:	c3                   	retq   
    3bb5:	0f 1f 00             	nopl   (%rax)
    3bb8:	c3                   	retq   
    3bb9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax) */

void fun_3bd0_help()
{
    /*3bc0:	f3 0f 1e fa          	endbr64 
    3bc4:	e9 77 ff ff ff       	jmpq   3b40 <__sprintf_chk@plt+0x13d0>
    3bc9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    3bd0:	50                   	push   %rax
    3bd1:	58                   	pop    %rax
    3bd2:	31 ff                	xor    %edi,%edi
    3bd4:	ba 05 00 00 00       	mov    $0x5,%edx
    3bd9:	48 8d 35 58 27 00 00 	lea    0x2758(%rip),%rsi        # 6338 <_IO_stdin_used@@Base+0x338>
    3be0:	48 83 ec 08          	sub    $0x8,%rsp
    3be4:	e8 17 e9 ff ff       	callq  2500 <dcgettext@plt>
    3be9:	48 8b 3d 30 58 00 00 	mov    0x5830(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3bf0:	be 01 00 00 00       	mov    $0x1,%esi
    3bf5:	48 89 c2             	mov    %rax,%rdx
    3bf8:	31 c0                	xor    %eax,%eax
    3bfa:	e8 21 eb ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "Usage: pstree [-acglpsStTuZ] [ -h | -H PID ] [ -n | -N type ]\n   [ -A | -G | -U ] [ PID | USER ]\n   or: pstree -V\n");

    /*3bff:	31 ff                	xor    %edi,%edi
    3c01:	ba 05 00 00 00       	mov    $0x5,%edx
    3c06:	48 8d 35 ab 27 00 00 	lea    0x27ab(%rip),%rsi        # 63b8 <_IO_stdin_used@@Base+0x3b8>
    3c0d:	e8 ee e8 ff ff       	callq  2500 <dcgettext@plt>
    3c12:	48 8b 3d 07 58 00 00 	mov    0x5807(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3c19:	be 01 00 00 00       	mov    $0x1,%esi
    3c1e:	48 89 c2             	mov    %rax,%rdx
    3c21:	31 c0                	xor    %eax,%eax
    3c23:	e8 f8 ea ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "\nDisplay a tree of processes.\n\n");

    /*3c28:	31 ff                	xor    %edi,%edi
    3c2a:	ba 05 00 00 00       	mov    $0x5,%edx
    3c2f:	48 8d 35 a2 27 00 00 	lea    0x27a2(%rip),%rsi        # 63d8 <_IO_stdin_used@@Base+0x3d8>
    3c36:	e8 c5 e8 ff ff       	callq  2500 <dcgettext@plt>
    3c3b:	48 8b 3d de 57 00 00 	mov    0x57de(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3c42:	be 01 00 00 00       	mov    $0x1,%esi
    3c47:	48 89 c2             	mov    %rax,%rdx
    3c4a:	31 c0                	xor    %eax,%eax
    3c4c:	e8 cf ea ff ff       	callq  2720 <__fprintf_chk@plt>*/
         fprintf(stderr, "%s", "  -a, --arguments     show command line arguments\n  -A, --ascii         use ASCII line drawing characters\n  -c, --compact-not   don't compact identical subtrees\n");

    /*3c51:	31 ff                	xor    %edi,%edi
    3c53:	ba 05 00 00 00       	mov    $0x5,%edx
    3c58:	48 8d 35 21 28 00 00 	lea    0x2821(%rip),%rsi        # 6480 <_IO_stdin_used@@Base+0x480>
    3c5f:	e8 9c e8 ff ff       	callq  2500 <dcgettext@plt>
    3c64:	48 8b 3d b5 57 00 00 	mov    0x57b5(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3c6b:	be 01 00 00 00       	mov    $0x1,%esi
    3c70:	48 89 c2             	mov    %rax,%rdx
    3c73:	31 c0                	xor    %eax,%eax
    3c75:	e8 a6 ea ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "  -C, --color=TYPE    color process by attribute\n    (age)\n");

    /*3c7a:	31 ff                	xor    %edi,%edi
    3c7c:	ba 05 00 00 00       	mov    $0x5,%edx
    3c81:	48 8d 35 48 28 00 00 	lea    0x2848(%rip),%rsi        # 64d0 <_IO_stdin_used@@Base+0x4d0>
    3c88:	e8 73 e8 ff ff       	callq  2500 <dcgettext@plt>
    3c8d:	48 8b 3d 8c 57 00 00 	mov    0x578c(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3c94:	be 01 00 00 00       	mov    $0x1,%esi
    3c99:	48 89 c2             	mov    %rax,%rdx
    3c9c:	31 c0                	xor    %eax,%eax
    3c9e:	e8 7d ea ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "  -g, --show-pgids    show process group ids; implies -c\n  -G, --vt100         use VT100 line drawing characters\n");

    /*3ca3:	31 ff                	xor    %edi,%edi
    3ca5:	ba 05 00 00 00       	mov    $0x5,%edx
    3caa:	48 8d 35 97 28 00 00 	lea    0x2897(%rip),%rsi        # 6548 <_IO_stdin_used@@Base+0x548>
    3cb1:	e8 4a e8 ff ff       	callq  2500 <dcgettext@plt>
    3cb6:	48 8b 3d 63 57 00 00 	mov    0x5763(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3cbd:	be 01 00 00 00       	mov    $0x1,%esi
    3cc2:	48 89 c2             	mov    %rax,%rdx
    3cc5:	31 c0                	xor    %eax,%eax
    3cc7:	e8 54 ea ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "  -h, --highlight-all highlight current process and its ancestors\n  -H PID, --highlight-pid=PID\n highlight this process and its ancestors\n  -l, --long          don't truncate long lines\n");

    /*3ccc:	31 ff                	xor    %edi,%edi
    3cce:	ba 05 00 00 00       	mov    $0x5,%edx
    3cd3:	48 8d 35 3e 29 00 00 	lea    0x293e(%rip),%rsi        # 6618 <_IO_stdin_used@@Base+0x618>
    3cda:	e8 21 e8 ff ff       	callq  2500 <dcgettext@plt>
    3cdf:	48 8b 3d 3a 57 00 00 	mov    0x573a(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3ce6:	be 01 00 00 00       	mov    $0x1,%esi
    3ceb:	48 89 c2             	mov    %rax,%rdx
    3cee:	31 c0                	xor    %eax,%eax
    3cf0:	e8 2b ea ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "  -n, --numeric-sort  sort output by PID\n  -N TYPE, --ns-sort=TYPE\n sort output by this namespace type\n cgroup, ipc, mnt, net, pid, user, uts)\n  -p, --show-pids     show PIDs; implies -c\n");

    /*3cf5:	31 ff                	xor    %edi,%edi
    3cf7:	ba 05 00 00 00       	mov    $0x5,%edx
    3cfc:	48 8d 35 05 2a 00 00 	lea    0x2a05(%rip),%rsi        # 6708 <_IO_stdin_used@@Base+0x708>
    3d03:	e8 f8 e7 ff ff       	callq  2500 <dcgettext@plt>
    3d08:	48 8b 3d 11 57 00 00 	mov    0x5711(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3d0f:	be 01 00 00 00       	mov    $0x1,%esi
    3d14:	48 89 c2             	mov    %rax,%rdx
    3d17:	31 c0                	xor    %eax,%eax
    3d19:	e8 02 ea ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "  -s, --show-parents  show parents of the selected process\n  -S, --ns-changes    show namespace transitions\n  -t, --thread-names  show full thread names\n  -T, --hide-threads  hide threads, show only processes\n");

    /*3d1e:	ba 05 00 00 00       	mov    $0x5,%edx
    3d23:	48 8d 35 b6 2a 00 00 	lea    0x2ab6(%rip),%rsi        # 67e0 <_IO_stdin_used@@Base+0x7e0>
    3d2a:	31 ff                	xor    %edi,%edi
    3d2c:	e8 cf e7 ff ff       	callq  2500 <dcgettext@plt>
    3d31:	48 8b 3d e8 56 00 00 	mov    0x56e8(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3d38:	be 01 00 00 00       	mov    $0x1,%esi
    3d3d:	48 89 c2             	mov    %rax,%rdx
    3d40:	31 c0                	xor    %eax,%eax
    3d42:	e8 d9 e9 ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "  -u, --uid-changes   show uid transitions\n  -U, --unicode       use UTF-8 (Unicode) line drawing characters\n  -V, --version       display version information\n");

    /*3d47:	ba 05 00 00 00       	mov    $0x5,%edx
    3d4c:	48 8d 35 2d 2b 00 00 	lea    0x2b2d(%rip),%rsi        # 6880 <_IO_stdin_used@@Base+0x880>
    3d53:	31 ff                	xor    %edi,%edi
    3d55:	e8 a6 e7 ff ff       	callq  2500 <dcgettext@plt>
    3d5a:	48 8b 3d bf 56 00 00 	mov    0x56bf(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3d61:	be 01 00 00 00       	mov    $0x1,%esi
    3d66:	48 89 c2             	mov    %rax,%rdx
    3d69:	31 c0                	xor    %eax,%eax
    3d6b:	e8 b0 e9 ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "  -Z, --security-context\n show SELinux security contexts\n");

    /*3d70:	ba 05 00 00 00       	mov    $0x5,%edx
    3d75:	48 8d 35 54 2b 00 00 	lea    0x2b54(%rip),%rsi        # 68d0 <_IO_stdin_used@@Base+0x8d0>
    3d7c:	31 ff                	xor    %edi,%edi
    3d7e:	e8 7d e7 ff ff       	callq  2500 <dcgettext@plt>
    3d83:	48 8b 3d 96 56 00 00 	mov    0x5696(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    3d8a:	be 01 00 00 00       	mov    $0x1,%esi
    3d8f:	48 89 c2             	mov    %rax,%rdx
    3d92:	31 c0                	xor    %eax,%eax
    3d94:	e8 87 e9 ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "\n  PID    start at this PID; default is 1 (init)\n  USER   show only trees rooted at processes of this user\n\n");

    /*3d99:	bf 01 00 00 00       	mov    $0x1,%edi
    3d9e:	e8 5d e9 ff ff       	callq  2700 <exit@plt>
    3da3:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    3daa:	00 00 00 00 
    3dae:	66 90                	xchg   %ax,%ax*/
}

static void fun_3db0(PROC *r, int id, struct ns_entry **root)
{
    CHILD *walk, *next;
    struct ns_entry *ptr, *last = NULL;
    CHILD *tmp_child, **c;

    /*3db0:	41 56                	push   %r14
    3db2:	41 55                	push   %r13
    3db4:	49 89 d5             	mov    %rdx,%r13    // r13=rdx=root
    3db7:	41 54                	push   %r12
    3db9:	41 89 f4             	mov    %esi,%r12d   // r12d=esi=nsid=id
    3dbc:	55                   	push   %rbp
    3dbd:	53                   	push   %rbx
    3dbe:	48 89 fb             	mov    %rdi,%rbx    // rbx=rdi=r
    3dc1:	48 85 ff             	test   %rdi,%rdi    // rdi=r
    3dc4:	0f 84 1e 01 00 00    	je     3ee8 <__sprintf_chk@plt+0x1778>*/
    if (r == NULL) {
        // je 3ee8
        r = find_proc(1);
        if (!r)
            return;
    }

    /*3dca:	48 8b 83 b8 00 00 00 	mov    0xb8(%rbx),%rax  // rax=r->parent
    3dd1:	48 85 c0             	test   %rax,%rax        // r->parent ?= NULL
    3dd4:	74 13                	je     3de9 <__sprintf_chk@plt+0x1679>
    3dd6:	44 89 e2             	mov    %r12d,%edx       // edx=id
    3dd9:	48 8b 4c d3 68       	mov    0x68(%rbx,%rdx,8),%rcx   // rcx=r->ns[id]
    3dde:	48 39 4c d0 68       	cmp    %rcx,0x68(%rax,%rdx,8)   // r->parent->ns[id]
    3de3:	0f 84 cb 00 00 00    	je     3eb4 <__sprintf_chk@plt+0x1744>*/
    if (r->parent == NULL || r->parent->ns[id] != r->ns[id]) {
        // je 3de9

    /*3de9:	49 8b 6d 00          	mov    0x0(%r13),%rbp   // rbp=*root    从root(一级指针自身地址)变成*root(一级指针指向地址)，再来一个(),就变成**root(一级指针指向地址上的值)
    3ded:	48 85 ed             	test   %rbp,%rbp        // ptr=*root
    3df0:	0f 84 52 01 00 00    	je     3f48 <__sprintf_chk@plt+0x17d8>*/    // ptr == NULL
        for (ptr = *root; ptr; ptr = ptr->next) {            
    
    /*3df6:	44 89 e0             	mov    %r12d,%eax               // eax=id
    3df9:	4c 8d 34 c3          	lea    (%rbx,%rax,8),%r14       // r14=
    3dfd:	49 8b 56 68          	mov    0x68(%r14),%rdx          // rdx=r->ns[id]
    3e01:	eb 15                	jmp    3e18 <__sprintf_chk@plt+0x16a8>
    3e03:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)

    3e08:	48 8b 45 10          	mov    0x10(%rbp),%rax          // rax=ptr->next
    3e0c:	48 85 c0             	test   %rax,%rax                // 
    3e0f:	0f 84 0b 01 00 00    	je     3f20 <__sprintf_chk@plt+0x17b0>      // ptr->next == NULL
    3e15:	48 89 c5             	mov    %rax,%rbp                // ptr=ptr->next

    3e18:	48 39 55 00          	cmp    %rdx,0x0(%rbp)           // ptr->number ?= r->ns[id]
    3e1c:	75 ea                	jne    3e08 <__sprintf_chk@plt+0x1698>*/
            if (ptr->number == r->ns[id])
                break;
            last = ptr;     // ac ????
        }

        /* 3f48 -> 3f3f -> 3e40 */
        /* 3f20 -> 3e40 */
        if (!ptr) {
            ptr = calloc(0x18, 1);
            if (ptr == NULL) {
                perror("calloc");
                exit(1);
            }

            ptr->number = r->ns[id];
        }

    /*3e1e:	48 8b 45 08          	mov    0x8(%rbp),%rax       // rax=ptr->children
    3e22:	48 85 c0             	test   %rax,%rax
    3e25:	0f 84 42 01 00 00    	je     3f6d <__sprintf_chk@plt+0x17fd>  // -> 3f3f -> 3e40
    3e2b:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
    3e30:	48 89 c2             	mov    %rax,%rdx            // rdx=ptr->children
    3e33:	48 8b 40 08          	mov    0x8(%rax),%rax       // rax=ptr->children->next
    3e37:	48 85 c0             	test   %rax,%rax
    3e3a:	75 f4                	jne    3e30 <__sprintf_chk@plt+0x16c0>
    3e3c:	48 8d 6a 08          	lea    0x8(%rdx),%rbp*/     // rbp=&ptr->children->next
        for (c = &ptr->children; *c; c = &(*c)->next);

    /*3e40:	bf 10 00 00 00       	mov    $0x10,%edi           // edi=0x10
    3e45:	e8 f6 e7 ff ff       	callq  2640 <malloc@plt>    // malloc(0x10)
    3e4a:	48 89 45 00          	mov    %rax,0x0(%rbp)       // *c=malloc(0x10)
    3e4e:	48 85 c0             	test   %rax,%rax
    3e51:	0f 84 1b 01 00 00    	je     3f72 <__sprintf_chk@plt+0x1802>*/  // perror, exit
        *c = malloc(0x10);
        if (*c == NULL) {
            perror("malloc");
            exit(1);
        }
    /*3e57:	48 89 18             	mov    %rbx,(%rax)          // (*c)->child=r
    3e5a:	48 c7 40 08 00 00 00 	movq   $0x0,0x8(%rax)       // (*c)->next=NULL
    3e61:	00 */
        (*c)->child = r;
        (*c)->next = NULL;

    /*3e62:	48 8b 83 b8 00 00 00 	mov    0xb8(%rbx),%rax      // rax=r->parent
    3e69:	48 85 c0             	test   %rax,%rax
    3e6c:	74 46                	je     3eb4 <__sprintf_chk@plt+0x1744>*/
        if (r->parent) {

    /*3e6e:	48 8b a8 b0 00 00 00 	mov    0xb0(%rax),%rbp  // rbp=r->parent->children
    3e75:	4c 8d b0 b0 00 00 00 	lea    0xb0(%rax),%r14  // r14=c=&r->parent->children
    3e7c:	48 85 ed             	test   %rbp,%rbp*/
            for (c = &r->parent->children; *c; c = &(*c)->next) {                

    /*3e7f:	75 10                	jne    3e91 <__sprintf_chk@plt+0x1721>
    3e81:	eb 26                	jmp    3ea9 <__sprintf_chk@plt+0x1739>
    3e83:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
    3e88:	4c 8d 77 08          	lea    0x8(%rdi),%r14   // r14=c=&r->parent->children->next
    3e8c:	48 85 ed             	test   %rbp,%rbp
    3e8f:	74 18                	je     3ea9 <__sprintf_chk@plt+0x1739>
    3e91:	48 8b 45 00          	mov    0x0(%rbp),%rax   // rax=r->parent->children->child
    3e95:	48 89 ef             	mov    %rbp,%rdi        // rdi=r->parent->children
    3e98:	48 8b 6d 08          	mov    0x8(%rbp),%rbp   // rbp=r->parent->children->next
    3e9c:	48 39 c3             	cmp    %rax,%rbx        // r ?= r->parent->children->child
    3e9f:	75 e7                	jne    3e88 <__sprintf_chk@plt+0x1718>*/
                if ((*c)->child == r) {

    /*3ea1:	e8 5a e5 ff ff       	callq  2400 <free@plt>  // free(r->parent->children)
    3ea6:	49 89 2e             	mov    %rbp,(%r14)*/    // r14=*c=r->parent->children->next
                    tmp_child = (*c)->next;
                    free(*c);
                    // *c = r->parent->children->next;
                    *c = tmp_child;
                    break;
                }
            }

    /*3ea9:	48 c7 83 b8 00 00 00 	movq   $0x0,0xb8(%rbx)      // r->parent=NULL
    3eb0:	00 00 00 00 */
            r->parent = NULL;
        }
    }

    /*3eb4:	48 8b 9b b0 00 00 00 	mov    0xb0(%rbx),%rbx      // rbx=walk=r->children
    3ebb:	48 85 db             	test   %rbx,%rbx            // r->children ?= NULL
    3ebe:	74 1a                	je     3eda <__sprintf_chk@plt+0x176a>
    3ec0:	48 89 d8             	mov    %rbx,%rax            // rax=r->children
    3ec3:	48 8b 5b 08          	mov    0x8(%rbx),%rbx       // rbx=next=r->children->next
    3ec7:	4c 89 ea             	mov    %r13,%rdx            // rdx=root
    3eca:	44 89 e6             	mov    %r12d,%esi           // esi=id
    3ecd:	48 8b 38             	mov    (%rax),%rdi          // rdi=r->children->child
    3ed0:	e8 db fe ff ff       	callq  3db0 <__sprintf_chk@plt+0x1640>  // fun_3db0(r->children, id, root)
    3ed5:	48 85 db             	test   %rbx,%rbx
    3ed8:	75 e6                	jne    3ec0 <__sprintf_chk@plt+0x1750>*/
    walk = r->children;
    while (walk) {
        next = walk->next;
        fun_3db0(walk->child, id, root);    // walk->child = r->children->child
        walk = next;
    }

    /*3eda:	5b                   	pop    %rbx
    3edb:	5d                   	pop    %rbp
    3edc:	41 5c                	pop    %r12
    3ede:	41 5d                	pop    %r13
    3ee0:	41 5e                	pop    %r14
    3ee2:	c3                   	retq   
    3ee3:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)*/

    /* if (r == NULL) jump */
    /*3ee8:	48 8b 1d 99 55 00 00 	mov    0x5599(%rip),%rbx        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // gvar_9488
    3eef:	48 85 db             	test   %rbx,%rbx
    3ef2:	74 e6                	je     3eda <__sprintf_chk@plt+0x176a>
    3ef4:	0f 1f 40 00          	nopl   0x0(%rax)
    3ef8:	83 7b 54 01          	cmpl   $0x1,0x54(%rbx)      // find_proc(1)
    3efc:	0f 84 c8 fe ff ff    	je     3dca <__sprintf_chk@plt+0x165a>
    3f02:	48 8b 9b c0 00 00 00 	mov    0xc0(%rbx),%rbx
    3f09:	48 85 db             	test   %rbx,%rbx
    3f0c:	75 ea                	jne    3ef8 <__sprintf_chk@plt+0x1788>
    3f0e:	5b                   	pop    %rbx
    3f0f:	5d                   	pop    %rbp
    3f10:	41 5c                	pop    %r12
    3f12:	41 5d                	pop    %r13
    3f14:	41 5e                	pop    %r14
    3f16:	c3                   	retq   
    3f17:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
    3f1e:	00 00 */
}

    /*3f20:	be 01 00 00 00       	mov    $0x1,%esi
    3f25:	bf 18 00 00 00       	mov    $0x18,%edi
    3f2a:	e8 91 e6 ff ff       	callq  25c0 <calloc@plt>    calloc(0x18, 1)
    3f2f:	48 85 c0             	test   %rax,%rax
    3f32:	74 3e                	je     3f72 <__sprintf_chk@plt+0x1802>  // perror, exit
    3f34:	49 8b 56 68          	mov    0x68(%r14),%rdx      // rdx=r->ns
    3f38:	48 89 10             	mov    %rdx,(%rax)          // ptr->number=r->ns[0]
    3f3b:	48 89 45 10          	mov    %rax,0x10(%rbp)

    3f3f:	48 8d 68 08          	lea    0x8(%rax),%rbp       // rbp=c=&ptr->children
    3f43:	e9 f8 fe ff ff       	jmpq   3e40 <__sprintf_chk@plt+0x16d0>

    3f48:	be 01 00 00 00       	mov    $0x1,%esi            // esi=1
    3f4d:	bf 18 00 00 00       	mov    $0x18,%edi           // edi=0x18
    3f52:	e8 69 e6 ff ff       	callq  25c0 <calloc@plt>    // calloc(0x18, 1)
    3f57:	48 85 c0             	test   %rax,%rax        
    3f5a:	74 16                	je     3f72 <__sprintf_chk@plt+0x1802>  // perror, exit
        ptr = calloc(0x18, 1);
        if (ptr == NULL) {
            perror("calloc");
            exit(1);
        }
    3f5c:	44 89 e2             	mov    %r12d,%edx               // edx=id
    3f5f:	48 8b 54 d3 68       	mov    0x68(%rbx,%rdx,8),%rdx   // rdx=r->ns[id]
    3f64:	49 89 45 00          	mov    %rax,0x0(%r13)           // *root=ptr
    3f68:	48 89 10             	mov    %rdx,(%rax)              // ptr->number=r->ns[id]
        ptr->number = r->ns[id];
    3f6b:	eb d2                	jmp    3f3f <__sprintf_chk@plt+0x17cf>

    3f6d:	48 89 e8             	mov    %rbp,%rax    // rax=ptr->children, rbp=
    3f70:	eb cd                	jmp    3f3f <__sprintf_chk@plt+0x17cf>

    3f72:	48 8d 3d 5d 21 00 00 	lea    0x215d(%rip),%rdi        # 60d6 <_IO_stdin_used@@Base+0xd6>
    3f79:	e8 62 e7 ff ff       	callq  26e0 <perror@plt>
    3f7e:	bf 01 00 00 00       	mov    $0x1,%edi
    3f83:	e8 78 e7 ff ff       	callq  2700 <exit@plt>
    3f88:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
    3f8f:	00 */

void fun_3f90(const char ch)
{
    /*3f90:	8b 05 9e 54 00 00    	mov    0x549e(%rip),%eax        # 9434 <stderr@@GLIBC_2.2.5+0x14>   // gvar_9434
    3f96:	85 c0                	test   %eax,%eax    // eax=gvar_9434
    3f98:	74 46                	je     3fe0 <__sprintf_chk@plt+0x1870>*/
    if (gvar_9434 == 0) {
        // 3fe0
        if ((ch & 0xe0) == 0xc0) {
            gvar_9434 = 1;
        } else if ((ch & 0xf0) == 0xe0) {
            gvar_9434 = 2;
        } else if ((ch & 0xf8) == 0xf0) {
            gvar_9434 = 3;
        } else {
            gvar_9434 = 1;
        }

        gvar_92c0++;
    }
    
    /*3f9a:	83 e8 01             	sub    $0x1,%eax                // gvar_9434 -= 1
    3f9d:	89 05 91 54 00 00    	mov    %eax,0x5491(%rip)        # 9434 <stderr@@GLIBC_2.2.5+0x14>*/     // gvar_9434
    gvar_9434 -= 1;

    /*3fa3:	8b 05 1f 53 00 00    	mov    0x531f(%rip),%eax        # 92c8 <_IO_stdin_used@@Base+0x32c8>    // gvar_92c8
    3fa9:	85 c0                	test   %eax,%eax
    3fab:	74 1b                	je     3fc8 <__sprintf_chk@plt+0x1858>*/

    /*3fad:	8b 15 0d 53 00 00    	mov    0x530d(%rip),%edx        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0
    3fb3:	8b 05 0b 53 00 00    	mov    0x530b(%rip),%eax        # 92c4 <_IO_stdin_used@@Base+0x32c4>    // gvar_92c4
    3fb9:	39 c2                	cmp    %eax,%edx
    3fbb:	7e 0b                	jle    3fc8 <__sprintf_chk@plt+0x1858>*/
    if (gvar_92c8 == 0 || gvar_92c0 <= gvar_92c4) {
        // je 3fc8
        // jle 3fc8
        putchar(ch);
    }
    
    /*3fbd:	83 c0 01             	add    $0x1,%eax
    3fc0:	39 c2                	cmp    %eax,%edx
    3fc2:	74 7c                	je     4040 <__sprintf_chk@plt+0x18d0>
    3fc4:	c3                   	retq   
    3fc5:	0f 1f 00             	nopl   (%rax)*/
    else if (gvar_92c8 != 0 && gvar_92c0 == gvar_92c4 + 1) {
        // je 4040
        putchar('+');            
    }
    
    /*3fc8:	48 8b 35 19 54 00 00 	mov    0x5419(%rip),%rsi        # 93e8 <stdout@@GLIBC_2.2.5>            // gvar_93e8
    3fcf:	40 0f be ff          	movsbl %dil,%edi            // edi=ch
    3fd3:	e9 08 e6 ff ff       	jmpq   25e0 <putc@plt>      // putchar(edi)     // 执行完后跳转到 4145
    3fd8:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
    3fdf:	00*/ 

    /* if (gvar_9434 == 0) */
    /*3fe0:	40 84 ff             	test   %dil,%dil        // 's'
    3fe3:	78 0b                	js     3ff0 <__sprintf_chk@plt+0x1880>  // sf=1
    3fe5:	83 05 d4 52 00 00 01 	addl   $0x1,0x52d4(%rip)        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0++
        gvar_92c0 += 1;
    3fec:	eb af                	jmp    3f9d <__sprintf_chk@plt+0x182d>      // 跳到函数开始处，需先处理gvar_9434=0的情况
    3fee:	66 90                	xchg   %ax,%ax

    3ff0:	89 f9                	mov    %edi,%ecx    // ecx=ch
    3ff2:	40 0f be d7          	movsbl %dil,%edx    // edx=ch
    3ff6:	81 e1 e0 00 00 00    	and    $0xe0,%ecx   // ecx=ch&0xe0
    3ffc:	81 f9 c0 00 00 00    	cmp    $0xc0,%ecx   // ch&0xe0?=0xc0
    4002:	74 2c                	je     4030 <__sprintf_chk@plt+0x18c0>
        if (ch & 0xe0 == 0xc0)
            gvar_9434=1;

    4004:	89 d1                	mov    %edx,%ecx    // ecx=ch
    4006:	81 e1 f0 00 00 00    	and    $0xf0,%ecx   // ecx=ch&0xf0
    400c:	81 f9 e0 00 00 00    	cmp    $0xe0,%ecx   // ch&0xf0?=0xe0
    4012:	74 44                	je     4058 <__sprintf_chk@plt+0x18e8>
        if (ch & 0xf0 == 0xe0)
            gvar_9434 = 2

    4014:	81 e2 f8 00 00 00    	and    $0xf8,%edx   // ch&0xf8
    401a:	81 fa f0 00 00 00    	cmp    $0xf0,%edx   // ch&0xf8?=0xf0
    4020:	ba 03 00 00 00       	mov    $0x3,%edx    // edx=3
    4025:	0f 44 c2             	cmove  %edx,%eax    // gvar_9434=3
        if (ch & 0xf8 == 0xf0)
            gvar_9434 = 3
    4028:	eb bb                	jmp    3fe5 <__sprintf_chk@plt+0x1875>  // -> 3f9d, 跳到函数开始处，需先处理gvar_9434=0的情况
    402a:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)

    4030:	b8 01 00 00 00       	mov    $0x1,%eax        // gvar_9434=1
    4035:	eb ae                	jmp    3fe5 <__sprintf_chk@plt+0x1875>  // -> 3f9d, 跳到函数开始处，需先处理gvar_9434=0的情况
    4037:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
    403e:	00 00 */
    
    /*4040:	48 8b 35 a1 53 00 00 	mov    0x53a1(%rip),%rsi        # 93e8 <stdout@@GLIBC_2.2.5>        // gvar_93e8
    4047:	bf 2b 00 00 00       	mov    $0x2b,%edi           // edi='+'
    404c:	e9 8f e5 ff ff       	jmpq   25e0 <putc@plt>      // putchar('+')     // 执行完后跳转到 4145
    4051:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)

    4058:	b8 02 00 00 00       	mov    $0x2,%eax        // gvar_9434=2
    405d:	eb 86                	jmp    3fe5 <__sprintf_chk@plt+0x1875>  // -> 3f9d, 跳到函数开始处，需先处理gvar_9434=0的情况
    405f:	90                   	nop*/
}

int fun_4060(int x)
{
    /*4060:	41 55                	push   %r13
    4062:	41 54                	push   %r12
    4064:	55                   	push   %rbp
    4065:	53                   	push   %rbx
    4066:	48 83 ec 08          	sub    $0x8,%rsp
    406a:	85 ff                	test   %edi,%edi        // x ?= 0
    406c:	0f 84 7e 00 00 00    	je     40f0 <__sprintf_chk@plt+0x1980>*/
    int digits, div;
    if (x != 0) {
    
    /*4072:	89 fd                	mov    %edi,%ebp        // ebp=edi=x
    4074:	b9 01 00 00 00       	mov    $0x1,%ecx        // ecx=div=1
    4079:	45 31 e4             	xor    %r12d,%r12d      // digits=0
    407c:	0f 1f 40 00          	nopl   0x0(%rax)*/
        digits = 0;
        for (div = 1; x / div; div *= 10)

    /*4080:	89 e8                	mov    %ebp,%eax        // eax=x
    4082:	89 cb                	mov    %ecx,%ebx        // ebx=div
    4084:	8d 0c 89             	lea    (%rcx,%rcx,4),%ecx   // ecx=div+div*4, 5个div
    4087:	41 83 c4 01          	add    $0x1,%r12d       // r12d=digits++
    408b:	01 c9                	add    %ecx,%ecx        // ecx=div=div*10, 5个div + 5个div ==> div*10
    408d:	99                   	cltd   
    408e:	f7 f9                	idiv   %ecx             // eax=eax/ecx=x/div
    4090:	85 c0                	test   %eax,%eax        // x/div ?= 0
    4092:	75 ec                	jne    4080 <__sprintf_chk@plt+0x1910>*/
            digits++;

    /*4094:	41 bd cd cc cc cc    	mov    $0xcccccccd,%r13d    // r13=0xcccccccd=‭3435973837‬
    409a:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)*/
        for (div /= 10; div; div /= 10)

    /*40a0:	89 e8                	mov    %ebp,%eax        // eax=x
    40a2:	99                   	cltd   
    40a3:	f7 fb                	idiv   %ebx             // eax=x/div
    40a5:	89 db                	mov    %ebx,%ebx        // ebx=div
    40a7:	49 0f af dd          	imul   %r13,%rbx        // rbx=div*‭3435973837‬
    40ab:	48 c1 eb 23          	shr    $0x23,%rbx       // rbx=(div*‭3435973837‬)>>0x23, rbx 存放余数
    40af:	48 63 d0             	movslq %eax,%rdx        // rdx=x/div， eax 存放商
    40b2:	89 c1                	mov    %eax,%ecx        // ecx=x/div
    40b4:	48 69 d2 67 66 66 66 	imul   $0x66666667,%rdx,%rdx    // rdx=(x/div)*‭1717986919‬
    40bb:	c1 f9 1f             	sar    $0x1f,%ecx       // ecx=(x/div)>>0x1f
    40be:	48 c1 fa 22          	sar    $0x22,%rdx       // rdx=((x/div)*‭1717986919‬)>>0x22
    40c2:	29 ca                	sub    %ecx,%edx        // edx=((x/div)*‭1717986919‬)>>0x22 - (x/div)>>0x1f
    40c4:	8d 14 92             	lea    (%rdx,%rdx,4),%edx   // edx=div+div*4=5*div
    40c7:	01 d2                	add    %edx,%edx            // edx=10*div
    40c9:	29 d0                	sub    %edx,%eax            // eax=eax-10*div --> div/10
    40cb:	8d 78 30             	lea    0x30(%rax),%edi      // edi=0x30+(x/div)
    40ce:	40 0f b6 ff          	movzbl %dil,%edi
    40d2:	e8 b9 fe ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)
    40d7:	85 db                	test   %ebx,%ebx        // ebx=div
    40d9:	75 c5                	jne    40a0 <__sprintf_chk@plt+0x1930>*/
            fun_3f90('0' + (x / div) % 10);

    /*40db:	48 83 c4 08          	add    $0x8,%rsp
    40df:	44 89 e0             	mov    %r12d,%eax       // eax=digits
    40e2:	5b                   	pop    %rbx
    40e3:	5d                   	pop    %rbp
    40e4:	41 5c                	pop    %r12
    40e6:	41 5d                	pop    %r13
    40e8:	c3                   	retq   
    40e9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/
        return digits;
    }

    /*40f0:	48 83 c4 08          	add    $0x8,%rsp
    40f4:	41 bc 01 00 00 00    	mov    $0x1,%r12d       // r12d=digits=0x1
    40fa:	5b                   	pop    %rbx
    40fb:	44 89 e0             	mov    %r12d,%eax       // eax=0x1
    40fe:	5d                   	pop    %rbp
    40ff:	41 5c                	pop    %r12
    4101:	41 5d                	pop    %r13
    4103:	c3                   	retq   
    4104:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    410b:	00 00 00 00 
    410f:	90                   	nop*/
    return 0x1;
}

int fun_4110(char *str)
{
    char *here;
    int count = 0;
    char temp[5] = {0};

    /*4110:	41 55                	push   %r13
    4112:	41 54                	push   %r12
    4114:	45 31 e4             	xor    %r12d,%r12d      // count=0
    4117:	55                   	push   %rbp
    4118:	53                   	push   %rbx
    4119:	48 89 fb             	mov    %rdi,%rbx        // rbx=rdi=str
    411c:	48 83 ec 18          	sub    $0x18,%rsp
    4120:	0f be 3f             	movsbl (%rdi),%edi      // edi=here=str
    4123:	64 48 8b 04 25 28 00 	mov    %fs:0x28,%rax
    412a:	00 00 
    412c:	48 89 44 24 08       	mov    %rax,0x8(%rsp)   // (rsp+0x8)=%fs:0x28
    4131:	31 c0                	xor    %eax,%eax        // eax=0
    4133:	40 84 ff             	test   %dil,%dil        // *here ?= 0
    4136:	74 7c                	je     41b4 <__sprintf_chk@plt+0x1a44>*/
    for (here = str; *here; here++) {

    /*4138:	48 8d 6c 24 03       	lea    0x3(%rsp),%rbp
    413d:	eb 17                	jmp    4156 <__sprintf_chk@plt+0x19e6>
    413f:	90                   	nop

    4140:	e8 4b fe ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)
    4145:	41 83 c4 01          	add    $0x1,%r12d       // r12d=(cout+1)||(cout+2)
    4149:	0f be 7b 01          	movsbl 0x1(%rbx),%edi   // here++
    414d:	48 83 c3 01          	add    $0x1,%rbx        // rbx=str++
    4151:	40 84 ff             	test   %dil,%dil        // dil=*here
    4154:	74 5e                	je     41b4 <__sprintf_chk@plt+0x1a44>

    4156:	40 80 ff 5c          	cmp    $0x5c,%dil       // 0x5c='\\'
    415a:	74 7c                	je     41d8 <__sprintf_chk@plt+0x1a68>*/    // jmpq 4149
        if (*here == '\\') {
            out_string("\\\\");
            count += 2;
        }

    /*415c:	8d 47 e0             	lea    -0x20(%rdi),%eax // 0x20=' '
    415f:	3c 5e                	cmp    $0x5e,%al        // 0x5e+0x20='~', 0x5e='^'
    4161:	76 dd                	jbe    4140 <__sprintf_chk@plt+0x19d0>*/
        else if (*here >= ' ' && *here <= '~') {
            // jbe 4140
            fun_3f90(*here);
            count++;
        }
        else {
    /*4163:	44 0f b6 c7          	movzbl %dil,%r8d        // r8d=*here
    4167:	48 8d 0d 72 1f 00 00 	lea    0x1f72(%rip),%rcx        # 60e0 <_IO_stdin_used@@Base+0xe0>  // "\\%03o"
    416e:	48 89 ef             	mov    %rbp,%rdi
    4171:	31 c0                	xor    %eax,%eax
    4173:	ba 05 00 00 00       	mov    $0x5,%edx        // edx=5
    4178:	be 01 00 00 00       	mov    $0x1,%esi        // esi=0x1
    417d:	e8 ee e5 ff ff       	callq  2770 <__sprintf_chk@plt>*/
            sprintf(temp, "\\%03o", (unsigned char) *here);
            // __sprintf_chk(temp, 1, 5, "\\%03o", (unsigned char) *here);

    /*4182:	0f be 7c 24 03       	movsbl 0x3(%rsp),%edi
    4187:	40 84 ff             	test   %dil,%dil
    418a:	74 17                	je     41a3 <__sprintf_chk@plt+0x1a33>
    418c:	49 89 ed             	mov    %rbp,%r13
    418f:	90                   	nop
    4190:	e8 fb fd ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    4195:	41 0f be 7d 01       	movsbl 0x1(%r13),%edi
    419a:	49 83 c5 01          	add    $0x1,%r13
    419e:	40 84 ff             	test   %dil,%dil
    41a1:	75 ed                	jne    4190 <__sprintf_chk@plt+0x1a20>*/
            out_string(temp);

    /*41a3:	0f be 7b 01          	movsbl 0x1(%rbx),%edi
    41a7:	48 83 c3 01          	add    $0x1,%rbx
    41ab:	41 83 c4 04          	add    $0x4,%r12d*/     // r12d=count+4
            count += 4;
        }

    /*41af:	40 84 ff             	test   %dil,%dil
    41b2:	75 a2                	jne    4156 <__sprintf_chk@plt+0x19e6>*/
    }

    /*41b4:	48 8b 44 24 08       	mov    0x8(%rsp),%rax   // (rsp+0x8)=%fs:0x28
    41b9:	64 48 33 04 25 28 00 	xor    %fs:0x28,%rax
    41c0:	00 00 
    41c2:	75 38                	jne    41fc <__sprintf_chk@plt+0x1a8c>
    41c4:	48 83 c4 18          	add    $0x18,%rsp
    41c8:	44 89 e0             	mov    %r12d,%eax       // eax=r12d=count;
    41cb:	5b                   	pop    %rbx
    41cc:	5d                   	pop    %rbp
    41cd:	41 5c                	pop    %r12
    41cf:	41 5d                	pop    %r13
    41d1:	c3                   	retq   
    41d2:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)*/
    return count;
}
    
    /*41d8:	4c 8d 2d fe 1e 00 00 	lea    0x1efe(%rip),%r13        # 60dd <_IO_stdin_used@@Base+0xdd>  // r13="\\\\"
    41df:	90                   	nop
    41e0:	e8 ab fd ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    41e5:	41 0f be 7d 01       	movsbl 0x1(%r13),%edi
    41ea:	49 83 c5 01          	add    $0x1,%r13
    41ee:	40 84 ff             	test   %dil,%dil
    41f1:	75 ed                	jne    41e0 <__sprintf_chk@plt+0x1a70>
        out_string("\\\\");

    41f3:	41 83 c4 02          	add    $0x2,%r12d               // count+2
        count += 2;
    41f7:	e9 4d ff ff ff       	jmpq   4149 <__sprintf_chk@plt+0x19d9>
    41fc:	e8 1f e3 ff ff       	callq  2520 <__stack_chk_fail@plt>      // __stack_chk_fail
    4201:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    4208:	00 00 00 00 
    420c:	0f 1f 40 00          	nopl   0x0(%rax)*/

void fun_4210(void)
{
    /*4210:	48 83 ec 08          	sub    $0x8,%rsp
    4214:	0f be 3d 21 52 00 00 	movsbl 0x5221(%rip),%edi        # 943c <stderr@@GLIBC_2.2.5+0x1c>       // gvar_943c
    421b:	48 8b 35 c6 51 00 00 	mov    0x51c6(%rip),%rsi        # 93e8 <stdout@@GLIBC_2.2.5>            // gvar_93e8
    4222:	40 84 ff             	test   %dil,%dil
    4225:	74 0e                	je     4235 <__sprintf_chk@plt+0x1ac5>
    4227:	8b 05 97 50 00 00    	mov    0x5097(%rip),%eax        # 92c4 <_IO_stdin_used@@Base+0x32c4>    // gvar_92c4
    422d:	39 05 8d 50 00 00    	cmp    %eax,0x508d(%rip)        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0
    4233:	74 23                	je     4258 <__sprintf_chk@plt+0x1ae8>*/
    if (gvar_943c && gvar_92c0 == gvar_92c4) {
        // je 4258
        putchar(gvar_943c);
    }

    /*4235:	bf 0a 00 00 00       	mov    $0xa,%edi
    423a:	c6 05 fb 51 00 00 00 	movb   $0x0,0x51fb(%rip)        # 943c <stderr@@GLIBC_2.2.5+0x1c>       // gvar_943c
    4241:	e8 9a e3 ff ff       	callq  25e0 <putc@plt>
    4246:	c7 05 70 50 00 00 01 	movl   $0x1,0x5070(%rip)        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0
    424d:	00 00 00 */
    gvar_943c = 0x0;
    putchar(0xa);
    gvar_92c0 = 1;

    /*4250:	48 83 c4 08          	add    $0x8,%rsp
    4254:	c3                   	retq   
    4255:	0f 1f 00             	nopl   (%rax)

    4258:	e8 83 e3 ff ff       	callq  25e0 <putc@plt>
    425d:	48 8b 35 84 51 00 00 	mov    0x5184(%rip),%rsi        # 93e8 <stdout@@GLIBC_2.2.5>            // gvar_93e8
    4264:	eb cf                	jmp    4235 <__sprintf_chk@plt+0x1ac5>
    4266:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    426d:	00 00 00 */
}

int fun_4270(const PROC * a, const PROC * b)
{
    const CHILD *walk_a, *walk_b;
    int i;

    /*4270:	55                   	push   %rbp
    4271:	48 89 f5             	mov    %rsi,%rbp        // rbp=b
    4274:	53                   	push   %rbx
    4275:	48 89 fb             	mov    %rdi,%rbx        // rbx=a
    4278:	48 83 ec 08          	sub    $0x8,%rsp
    427c:	e8 4f e3 ff ff       	callq  25d0 <strcmp@plt>
    4281:	85 c0                	test   %eax,%eax    
    4283:	0f 85 9f 00 00 00    	jne    4328 <__sprintf_chk@plt+0x1bb8>*/
    if (strcmp(a->comm, b->comm) != 0) {
        return 0;
    }

    /*4289:	8b 0d d5 51 00 00    	mov    0x51d5(%rip),%ecx        # 9464 <stderr@@GLIBC_2.2.5+0x44>       // gvar_9464
    428f:	85 c9                	test   %ecx,%ecx
    4291:	75 7d                	jne    4310 <__sprintf_chk@plt+0x1ba0>*/
    if (gvar_9464 && a->uid != b->uid) {
        return 0;
    }

    /*4293:	8b 15 b3 51 00 00    	mov    0x51b3(%rip),%edx        # 944c <stderr@@GLIBC_2.2.5+0x2c>       // gvar_944c
    4299:	85 d2                	test   %edx,%edx
    429b:	74 23                	je     42c0 <__sprintf_chk@plt+0x1b50>*/
    if (gvar_944c) {

    /*429d:	ba 68 00 00 00       	mov    $0x68,%edx               // edx=0x68
    42a2:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)

    42a8:	48 8b 4c 15 00       	mov    0x0(%rbp,%rdx,1),%rcx    // rcx=b+0x68=b->ns[i]
    42ad:	48 39 0c 13          	cmp    %rcx,(%rbx,%rdx,1)       // a->ns[i] ?= b->ns[i]
    42b1:	75 4f                	jne    4302 <__sprintf_chk@plt+0x1b92>  // return 
    42b3:	48 83 c2 08          	add    $0x8,%rdx                // rdx += 8
    42b7:	48 81 fa a0 00 00 00 	cmp    $0xa0,%rdx               // rdx ?= 0xa0, (0xa0-0x68)=0x38(56), 56/8=7
    42be:	75 e8                	jne    42a8 <__sprintf_chk@plt+0x1b38>*/
        for (i = 0; i < 0x7; i++)
            if (a->ns[i] != b->ns[i])
                return 0;
    }

    /*42c0:	48 8b ad b0 00 00 00 	mov    0xb0(%rbp),%rbp          // rbp=walk_b=b->children
    42c7:	48 8b 9b b0 00 00 00 	mov    0xb0(%rbx),%rbx          // rbx=walk_a=a->children
    42ce:	48 85 ed             	test   %rbp,%rbp
    42d1:	74 27                	je     42fa <__sprintf_chk@plt+0x1b8a>
    42d3:	48 85 db             	test   %rbx,%rbx
    42d6:	74 22                	je     42fa <__sprintf_chk@plt+0x1b8a>*/
    for (walk_a = a->children, walk_b = b->children; walk_a && walk_b;
         walk_a = walk_a->next, walk_b = walk_b->next) {

    /*42d8:	48 8b 75 00          	mov    0x0(%rbp),%rsi           // rsi=walk_b->child
    42dc:	48 8b 3b             	mov    (%rbx),%rdi              // rdi=walk_a->child
    42df:	e8 8c ff ff ff       	callq  4270 <__sprintf_chk@plt+0x1b00>  // fun_4270(a, b)
    42e4:	85 c0                	test   %eax,%eax
    42e6:	74 1a                	je     4302 <__sprintf_chk@plt+0x1b92>*/    // eax=0
        if (fun_4270(walk_a->child, walk_b->child) == 0) {
            // je 4302
            return 0;
        }

    /*42e8:	48 8b 5b 08          	mov    0x8(%rbx),%rbx           // walk_a=walk_a->next
    42ec:	48 8b 6d 08          	mov    0x8(%rbp),%rbp           // walk_b=walk_b->next
    42f0:	48 85 db             	test   %rbx,%rbx
    42f3:	74 05                	je     42fa <__sprintf_chk@plt+0x1b8a>
    42f5:	48 85 ed             	test   %rbp,%rbp
    42f8:	75 de                	jne    42d8 <__sprintf_chk@plt+0x1b68>*/
    }

    /*42fa:	31 c0                	xor    %eax,%eax
    42fc:	48 09 eb             	or     %rbp,%rbx     // rbp=walk_b, rbx=walk_a
    42ff:	0f 94 c0             	sete   %al           // !
    
    4302:	48 83 c4 08          	add    $0x8,%rsp
    4306:	5b                   	pop    %rbx
    4307:	5d                   	pop    %rbp
    4308:	c3                   	retq
    4309:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/
    return !(walk_a || walk_b);

    /*4310:	8b 4d 5c             	mov    0x5c(%rbp),%ecx      // ecx=b->uid
    4313:	39 4b 5c             	cmp    %ecx,0x5c(%rbx)      // a->uid ?= b->uid
    4316:	0f 84 77 ff ff ff    	je     4293 <__sprintf_chk@plt+0x1b23>
    431c:	48 83 c4 08          	add    $0x8,%rsp
    4320:	5b                   	pop    %rbx
    4321:	5d                   	pop    %rbp
    4322:	c3                   	retq  
    return 0;
    4323:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)*/
    
    /*4328:	48 83 c4 08          	add    $0x8,%rsp
    432c:	31 c0                	xor    %eax,%eax    // eax=0
    432e:	5b                   	pop    %rbx
    432f:	5d                   	pop    %rbp
    4330:	c3                   	retq   
    return 0;

    4331:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    4338:	00 00 00 00 
    433c:	0f 1f 40 00          	nopl   0x0(%rax)*/    
}

void fun_4340(PROC * current, int level, int rep, int leaf, int last,
          uid_t prev_uid, int closing)
{
    CHILD *walk, *next, *tmp_child, **scan;
    const struct passwd *pw;
    int lvl, i, add, offset, len, swapped, info, count, comm_len, first;
    const char *tmp, *here;

    /*4340:	41 57                	push   %r15
    4342:	41 56                	push   %r14
    4344:	41 55                	push   %r13
    4346:	49 89 fd             	mov    %rdi,%r13    // r13=current
    4349:	41 54                	push   %r12
    434b:	55                   	push   %rbp
    434c:	53                   	push   %rbx
    434d:	48 83 ec 28          	sub    $0x28,%rsp
    4351:	8b 44 24 60          	mov    0x60(%rsp),%eax  // eax=(rsp+0x60)=closing
    4355:	89 74 24 0c          	mov    %esi,0xc(%rsp)   // (rsp+0xc)=esi=level
    4359:	89 54 24 18          	mov    %edx,0x18(%rsp)  // (rsp+0x18)=edx=rep
    435d:	44 89 44 24 10       	mov    %r8d,0x10(%rsp)  // (rsp+0x10)=r8d=last
    4362:	44 89 4c 24 1c       	mov    %r9d,0x1c(%rsp)  // (rsp+0x1c)=r9d=prev_uid
    4367:	89 44 24 08          	mov    %eax,0x8(%rsp)   // (rsp+0x8)=eax=(rsp+0x60)=closing
    436b:	83 7c 24 08 ff       	cmpl   $0xffffffff,0x8(%rsp)    // (rsp+0x8) ?= -1
    4370:	0f 84 c4 0a 00 00    	je     4e3a <__sprintf_chk@plt+0x26ca>*/
    assert(closing >= 0);

    /*4376:	4d 85 ed             	test   %r13,%r13        // current ?= NULL
    4379:	0f 84 31 05 00 00    	je     48b0 <__sprintf_chk@plt+0x2140>*/  // 结束此函数
    if (current == NULL)
        return;
    
    /*437f:	85 c9                	test   %ecx,%ecx        // ecx=leaf
    4381:	0f 85 99 00 00 00    	jne    4420 <__sprintf_chk@plt+0x1cb0>*/    // 跳出 if (leaf == 0)
    if (leaf == 0) {

    /*4387:	8b 44 24 0c          	mov    0xc(%rsp),%eax   // eax=level
    438b:	85 c0                	test   %eax,%eax        // level ?= 0
    438d:	0f 8e 8d 00 00 00    	jle    4420 <__sprintf_chk@plt+0x1cb0>*/    // 跳出 if (leaf == 0)
        for (lvl = 0; lvl < level; lvl++) {

    /*4393:	44 8d 78 ff          	lea    -0x1(%rax),%r15d // r15=level-1
    4397:	31 ed                	xor    %ebp,%ebp        // ebp=lvl=0
    4399:	4d 89 fe             	mov    %r15,%r14        // r14=r15=level-1
    439c:	0f 1f 40 00          	nopl   0x0(%rax)

    43a0:	48 8b 05 d1 50 00 00 	mov    0x50d1(%rip),%rax        # 9478 <stderr@@GLIBC_2.2.5+0x58>   // rax=gvar_9478
    43a7:	4c 8d 24 ad 00 00 00 	lea    0x0(,%rbp,4),%r12        // rbp=ebp=lvl, r12=lvl*4
    43ae:	00 
    43af:	8b 1c a8             	mov    (%rax,%rbp,4),%ebx       // ebx=i=gvar_9478[lvl]
    43b2:	83 c3 01             	add    $0x1,%ebx                // ebx=i=gvar_9478[lvl]+1
    43b5:	74 18                	je     43cf <__sprintf_chk@plt+0x1c5f>  // 跳出for (i = gvar_9478[lvl] + 1; i; i--)循环
    43b7:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
    43be:	00 00 

    43c0:	bf 20 00 00 00       	mov    $0x20,%edi                       // edi=' '
    43c5:	e8 c6 fb ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)
    43ca:	83 eb 01             	sub    $0x1,%ebx                        // ebx=i-1
    43cd:	75 f1                	jne    43c0 <__sprintf_chk@plt+0x1c50>*/
            for (i = gvar_9478[lvl] + 1; i; i--)
                fun_3f90(' ');

    /*43cf:	48 8b 05 3a 4f 00 00 	mov    0x4f3a(%rip),%rax        # 9310 <age_to_color@@Base+0x30>    // 9310=shape_pointer
    43d6:	41 39 ee             	cmp    %ebp,%r14d               // level-1 ?= lvl
    43d9:	0f 84 49 07 00 00    	je     4b28 <__sprintf_chk@plt+0x23b8>  // edi=last ? (shape_pointer->four):(shape_pointer->second), jump 4409 
    43df:	48 8b 15 8a 50 00 00 	mov    0x508a(%rip),%rdx        # 9470 <stderr@@GLIBC_2.2.5+0x50>   // gvar_9470
    43e6:	42 8b 54 22 04       	mov    0x4(%rdx,%r12,1),%edx    // edx=gvar_9470+lvl*4+0x4=gvar_9470[lvl+1]
    43eb:	85 d2                	test   %edx,%edx                // edx ?= 0
    43ed:	0f 84 05 06 00 00    	je     49f8 <__sprintf_chk@plt+0x2288>  // rbx=shape_pointer->first,  jmpq 4409
    43f3:	48 8b 58 10          	mov    0x10(%rax),%rbx                  // rbx=shape_pointer->three
    43f7:	eb 10                	jmp    4409 <__sprintf_chk@plt+0x1c99>
    43f9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)

    4400:	48 83 c3 01          	add    $0x1,%rbx            // 循环调用 fun_3f90()，导出 out_string 封装
    4404:	e8 87 fb ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)

    4409:	0f be 3b             	movsbl (%rbx),%edi          // edi=gvar_9470[lvl+1] ? shape_pointer->three:shape_pointer->first
                                                                // edi=last ? (shape_pointer->four):(shape_pointer->second), 
    440c:	40 84 ff             	test   %dil,%dil
    440f:	75 ef                	jne    4400 <__sprintf_chk@plt+0x1c90>*/
            out_string(lvl == level - 1 ? last ? shape_pointer->four : shape_pointer->second : gvar_9470[lvl + 1] ?
                       shape_pointer->three : shape_pointer->first);
            // (0|1) ? last ? shape_pointer->four : shape_pointer->second : gvar_9470[lvl + 1] ? shape_pointer->three : shape_pointer->first
            // (0|1) ? shape_pointer->four|shape_pointer->second : shape_pointer->three|shape_pointer->first

    /*4411:	48 8d 45 01          	lea    0x1(%rbp),%rax                   // rax=(rbp+0x1)=lvl++
    4415:	49 39 ef             	cmp    %rbp,%r15                        // rbp=lvl, r15=level-1
    4418:	74 06                	je     4420 <__sprintf_chk@plt+0x1cb0>  // 跳出 if (leaf == 0)
    441a:	48 89 c5             	mov    %rax,%rbp                        // rbp=lvl
    441d:	eb 81                	jmp    43a0 <__sprintf_chk@plt+0x1c30>
    441f:	90                   	nop*/
        }
    }

    /* if (leaf != 0) */
    /*4420:	45 31 e4             	xor    %r12d,%r12d          // r12d=add=0
    4423:	83 7c 24 18 01       	cmpl   $0x1,0x18(%rsp)      // (rsp+0x18)=rep
    4428:	0f 8f ec 04 00 00    	jg     491a <__sprintf_chk@plt+0x21aa>*/
    add = 0;
    if (rep > 1) {
        // jg 491a
        add = fun_4060(rep) + 2;
        out_string("*[");
    }

    /*442e:	83 3d fb 4f 00 00 01 	cmpl   $0x1,0x4ffb(%rip)        # 9430 <stderr@@GLIBC_2.2.5+0x10>   // gvar_9430
    4435:	0f 84 1d 05 00 00    	je     4958 <__sprintf_chk@plt+0x21e8>*/
    if (gvar_9430 == 1) {
        // je 4958
        struct age_to_color *p;
        for(p = gvar_g2e0; p->age_seconds != 0; p++) {
            // jae 4978
            if (current->age < p->age_seconds)
                break;
        }

        char *strp = p->color;
        while (*strp) {
            fun_3f90(*strp++);
        }
    }

    /*443b:	41 f6 85 a0 00 00 00 	testb  $0x1,0xa0(%r13)      // current->flags & 0x1
    4442:	01 
    4443:	0f 85 78 05 00 00    	jne    49c1 <__sprintf_chk@plt+0x2251>*/
    if ((current->flags & 0x1) && (tmp=tgetstr("md", NULL))) {
        // jne 49c1
        tputs(tmp, 1, putchar);
        // jmpq   4449
    }
    else if (current->flags  & 0x1 && (tmp=tgetstr("md", NULL))) {
        // je 4449
        // 此分支可以省略
    }

    /*4449:	8b 2d 19 50 00 00    	mov    0x5019(%rip),%ebp        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468
    444f:	85 ed                	test   %ebp,%ebp                // gvar_9468 ?= 0
    4451:	0f 84 69 04 00 00    	je     48c0 <__sprintf_chk@plt+0x2150>*/
    swapped = info = gvar_9468;
#if 0
    if (gvar_9468 == 0) {
        // je 48c0 -> 44b0
        // jmpq 4d10 -> 44b0
        comm_len = fun_4110(current->comm);
        rep = gvar_92c0;
        if (gvar_9460 == 0) {
            // je 4cf5
            info = gvar_945c;
            if (gvar_945c == 0) {
                // je 44b0
            }
            info = 0x1;
            fun_3f90('(');
            fun_4060(current->pgid);
            // jmpq 44b0
        }

        fun_3f90('(');
        fun_4060(current->pid);
        if (gvar_945c == 0) {
            // je 44b0
        }
        fun_3f90(',');
        fun_4060(current->pgid);
        // jmpq 44b0
    }
#endif
    /*4457:	41 8b 45 50          	mov    0x50(%r13),%eax                  // eax=current->argc
    445b:	85 c0                	test   %eax,%eax
    445d:	0f 88 55 09 00 00    	js     4db8 <__sprintf_chk@plt+0x2648>*/
    if (gvar_9468 && current->argc < 0) {
        // js 4db8
        fun_3f90('(');
        // jmpq 4463
    }

    /*4463:	4c 89 ef             	mov    %r13,%rdi                        // rdi=current
    4466:	e8 a5 fc ff ff       	callq  4110 <__sprintf_chk@plt+0x19a0>  // fun_4110
    446b:	8b 3d ef 4f 00 00    	mov    0x4fef(%rip),%edi        # 9460 <stderr@@GLIBC_2.2.5+0x40>       // gvar_9460
    4471:	41 89 c6             	mov    %eax,%r14d*/             // comm_len=fun_4110(current->comm)
    comm_len = fun_4110(current->comm);

    /*4474:	8b 05 46 4e 00 00    	mov    0x4e46(%rip),%eax        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0
    447a:	89 44 24 18          	mov    %eax,0x18(%rsp)*/        // rep=gvar_92c0
    rep = gvar_92c0;

    /*447e:	85 ff                	test   %edi,%edi                // edi=gvar_9460
    4480:	0f 84 44 08 00 00    	je     4cca <__sprintf_chk@plt+0x255a>*/
#if 0
    if (gvar_9460 == 0) {
        // je 4cca -> 44b0
        // jmpq 4d10 -> 44b0
        if (gvar_945c == 0) {
            // je 44b0
            // 此处可忽略，因会顺利执行到 44b0
        } 
        else if (gvar_945c != 0) {
            fun_3f90(',');
            fun_4060(current->pgid);
            // jmpq 44b0
        }
    }
    else 
#endif

    if (gvar_9460 != 0) {
    /*4486:	bf 2c 00 00 00       	mov    $0x2c,%edi               // gvar_9460=0x2c=','
    448b:	44 8d 7d 01          	lea    0x1(%rbp),%r15d          // r15d=info=swapped+1
    448f:	e8 fc fa ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    4494:	41 8b 7d 54          	mov    0x54(%r13),%edi          // edi=current->pid
    4498:	e8 c3 fb ff ff       	callq  4060 <__sprintf_chk@plt+0x18f0>*/
        fun_3f90(',');
        (void) fun_4060(current->pid);
    }

    /*449d:	44 8b 05 b8 4f 00 00 	mov    0x4fb8(%rip),%r8d        # 945c <stderr@@GLIBC_2.2.5+0x3c>       // gvar_945c
    44a4:	45 85 c0             	test   %r8d,%r8d
    44a7:	0f 85 cb 08 00 00    	jne    4d78 <__sprintf_chk@plt+0x2608>
    44ad:	0f 1f 00             	nopl   (%rax)*/
    if (gvar_945c != 0) {
        // jne 4d78 -> 4d05 -> 44b0
        // jmpq 4d10 -> 44b0
        if (info == 0) {
            // je 4d05
            fun_3f90('(');
            fun_4060(current->pgid);
            // jmpq  44b0
        }
        fun_3f90(',');
        fun_4060(current->pgid);
        // jmpq  44b0
    }

    /*44b0:	8b 05 ae 4f 00 00    	mov    0x4fae(%rip),%eax        # 9464 <stderr@@GLIBC_2.2.5+0x44>       // gvar_9464
    44b6:	85 c0                	test   %eax,%eax
    44b8:	74 5d                	je     4517 <__sprintf_chk@plt+0x1da7>*/
    if (gvar_9464 == 0) {
        // je 4517
        // 此分支可以省略
    }
    
    /*44ba:	8b 44 24 1c          	mov    0x1c(%rsp),%eax          // eax=(rsp+0x1c)=prev_uid
    44be:	41 39 45 5c          	cmp    %eax,0x5c(%r13)          // current->uid
    44c2:	74 53                	je     4517 <__sprintf_chk@plt+0x1da7>*/
    if (gvar_9464 && prev_uid != current->uid) {

    /*44c4:	41 83 ff 01          	cmp    $0x1,%r15d               // r15d=info=swapped
    44c8:	41 8d 5f 01          	lea    0x1(%r15),%ebx           // ebx=info+1
    44cc:	19 ff                	sbb    %edi,%edi                // edi=0
    44ce:	83 e7 fc             	and    $0xfffffffc,%edi         // edi=$0xfffffffc&0
    44d1:	83 c7 2c             	add    $0x2c,%edi               // edi=edi+0x2c
    44d4:	e8 b7 fa ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>*/    // fun_3f90(const char ch)
        fun_3f90(',');

    /*44d9:	41 8b 7d 5c          	mov    0x5c(%r13),%edi          // edi=current->uid
    44dd:	e8 fe df ff ff       	callq  24e0 <getpwuid@plt>      // getpwuid(current->uid)
    44e2:	48 85 c0             	test   %rax,%rax
    44e5:	0f 84 f9 08 00 00    	je     4de4 <__sprintf_chk@plt+0x2674>*/
        if ((pw = getpwuid(current->uid))) {
    
    /*44eb:	4c 8b 38             	mov    (%rax),%r15      // r15=pw->pw_name
    44ee:	41 0f b6 07          	movzbl (%r15),%eax      // eax=pw->pw_name[0]
    44f2:	84 c0                	test   %al,%al
    44f4:	74 1e                	je     4514 <__sprintf_chk@plt+0x1da4>
    44f6:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    44fd:	00 00 00 
    4500:	0f be f8             	movsbl %al,%edi
    4503:	49 83 c7 01          	add    $0x1,%r15
    4507:	e8 84 fa ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    450c:	41 0f b6 07          	movzbl (%r15),%eax
    4510:	84 c0                	test   %al,%al
    4512:	75 ec                	jne    4500 <__sprintf_chk@plt+0x1d90>*/
            out_string(pw->pw_name);

    /*4514:	41 89 df             	mov    %ebx,%r15d*/
            info++;
        } 
        else {
            // je 4de4
            fun_4060(current->uid);
            // jmpq 4517
        }
    }

    /*4517:	8b 05 2f 4f 00 00    	mov    0x4f2f(%rip),%eax        # 944c <stderr@@GLIBC_2.2.5+0x2c>       // gvar_944c
    451d:	85 c0                	test   %eax,%eax
    451f:	0f 84 9f 00 00 00    	je     45c4 <__sprintf_chk@plt+0x1e54>
    4525:	49 83 bd b8 00 00 00 	cmpq   $0x0,0xb8(%r13)          // current->parent
    452c:	00 
    452d:	0f 84 91 00 00 00    	je     45c4 <__sprintf_chk@plt+0x1e54>*/
    if (gvar_944c && current->parent) {

    /*4533:	31 db                	xor    %ebx,%ebx                // i = 0
    4535:	89 6c 24 1c          	mov    %ebp,0x1c(%rsp)          // (rsp+0x1c)=ebp=info
    4539:	48 89 dd             	mov    %rbx,%rbp                // rbp=rbx=i
    453c:	eb 0c                	jmp    454a <__sprintf_chk@plt+0x1dda>

    453e:	66 90                	xchg   %ax,%ax
    4540:	48 83 c5 01          	add    $0x1,%rbp                // i++
    4544:	48 83 fd 07          	cmp    $0x7,%rbp                // i ?= 0x7
    4548:	74 76                	je     45c0 <__sprintf_chk@plt+0x1e50>*/
        for (i = 0; i < 0x7; i++) {

    /*454a:	49 8b 54 ed 68       	mov    0x68(%r13,%rbp,8),%rdx           // rdx=current->ns[i]
    454f:	48 85 d2             	test   %rdx,%rdx
    4552:	74 ec                	je     4540 <__sprintf_chk@plt+0x1dd0>  // current->ns[i] = 0
    4554:	49 8b 8d b8 00 00 00 	mov    0xb8(%r13),%rcx                  // rcx=current->parent
    455b:	48 63 f5             	movslq %ebp,%rsi
    455e:	48 8b 4c f1 68       	mov    0x68(%rcx,%rsi,8),%rcx           // current->parent->ns[i]
    4563:	48 39 ca             	cmp    %rcx,%rdx
    4566:	74 d8                	je     4540 <__sprintf_chk@plt+0x1dd0>  // current->ns[i] = current->parent->ns[i]
    4568:	48 85 c9             	test   %rcx,%rcx
    456b:	74 d3                	je     4540 <__sprintf_chk@plt+0x1dd0>*/    // current->parent->ns[i] = 0
            if (current->ns[i] == 0 || current->ns[i] == current->parent->ns[i] || current->parent->ns[i] == 0) {
                continue;
            }

    /*456d:	41 83 ff 01          	cmp    $0x1,%r15d           // r15d=info
    4571:	41 8d 5f 01          	lea    0x1(%r15),%ebx       // ebx=info+1
    4575:	19 ff                	sbb    %edi,%edi            // edi=-1或0
    4577:	83 e7 fc             	and    $0xfffffffc,%edi     // edi为-4，或者 0
    457a:	83 c7 2c             	add    $0x2c,%edi           // edi= 0x28='('    0x2c=','
    457d:	e8 0e fa ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>*/    // fun_3f90(const char ch)
            fun_3f90(info++ ? ',' : '(');

    /*4582:	48 8d 05 17 46 00 00 	lea    0x4617(%rip),%rax        # 8ba0 <_IO_stdin_used@@Base+0x2ba0>    // gvar_8ba0
    4589:	4c 8b 3c e8          	mov    (%rax,%rbp,8),%r15   // r15=gvar_8ba0[i]
    458d:	41 0f be 3f          	movsbl (%r15),%edi          // edi=gvar_8ba0[i][0]
    4591:	40 84 ff             	test   %dil,%dil
    4594:	74 1d                	je     45b3 <__sprintf_chk@plt+0x1e43>  // gvar_8ba0[i][0] = 0
    4596:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    459d:	00 00 00 
    45a0:	e8 eb f9 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    45a5:	41 0f be 7f 01       	movsbl 0x1(%r15),%edi       // edi=gvar_8ba0[i][1]...
    45aa:	49 83 c7 01          	add    $0x1,%r15            // r15=gvar_8ba0[i]+1
    45ae:	40 84 ff             	test   %dil,%dil
    45b1:	75 ed                	jne    45a0 <__sprintf_chk@plt+0x1e30>*/
            out_string(gvar_8ba0[i]);

    /*45b3:	48 83 c5 01          	add    $0x1,%rbp                            // i++
    45b7:	41 89 df             	mov    %ebx,%r15d                           // r15d=info
    45ba:	48 83 fd 07          	cmp    $0x7,%rbp                            // i ?= 0x7
    45be:	75 8a                	jne    454a <__sprintf_chk@plt+0x1dda>*/
        }

    /*45c0:	8b 6c 24 1c          	mov    0x1c(%rsp),%ebp*/                // (rsp+0x1c)=0x00000007
    }
    
    /*45c4:	8b 1d 76 4e 00 00    	mov    0x4e76(%rip),%ebx        # 9440 <stderr@@GLIBC_2.2.5+0x20>   // gvar_9440
    45ca:	85 db                	test   %ebx,%ebx
    45cc:	74 53                	je     4621 <__sprintf_chk@plt+0x1eb1>*/
    if (gvar_9440) {

    /*45ce:	41 83 ff 01          	cmp    $0x1,%r15d
    45d2:	41 8d 5f 01          	lea    0x1(%r15),%ebx       // ebx=info+1
    45d6:	19 ff                	sbb    %edi,%edi
    45d8:	83 e7 fc             	and    $0xfffffffc,%edi     // edi为-4，或者 0
    45db:	83 c7 2c             	add    $0x2c,%edi           // edi= 0x28='('    0x2c=','
    45de:	e8 ad f9 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>*/  // fun_3f90(const char ch)
        fun_3f90(info++ ? ',' : '(');

    /*45e3:	4d 8b 7d 60          	mov    0x60(%r13),%r15      // r15=current->ns
    45e7:	bf 60 00 00 00       	mov    $0x60,%edi           // edi=0x60='`'
    45ec:	e8 9f f9 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    45f1:	41 0f b6 07          	movzbl (%r15),%eax          // eax=current->ns[0]
    45f5:	84 c0                	test   %al,%al
    45f7:	74 1b                	je     4614 <__sprintf_chk@plt+0x1ea4>
    45f9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/
        out_string("`");

    /*4600:	0f be f8             	movsbl %al,%edi
    4603:	49 83 c7 01          	add    $0x1,%r15
    4607:	e8 84 f9 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    460c:	41 0f b6 07          	movzbl (%r15),%eax
    4610:	84 c0                	test   %al,%al
    4612:	75 ec                	jne    4600 <__sprintf_chk@plt+0x1e90>

    4614:	bf 27 00 00 00       	mov    $0x27,%edi           // edi=0x27='\'
    4619:	41 89 df             	mov    %ebx,%r15d           // r15d=ebx=info
    461c:	e8 6f f9 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>*/  // fun_3f90(const char ch) 
        fun_3f90(current->ns[0] ? '`' : '\\');       // ????
    }

    /*4621:	85 ed                	test   %ebp,%ebp            // ebp=swapped
    4623:	0f 84 d7 03 00 00    	je     4a00 <__sprintf_chk@plt+0x2290>  // swapped=0, --> je 4a0f || fun_3f90(')')
    4629:	44 8b 1d 38 4e 00 00 	mov    0x4e38(%rip),%r11d        # 9468 <stderr@@GLIBC_2.2.5+0x48>  // gvar_9468
    4630:	45 85 db             	test   %r11d,%r11d
    4633:	0f 84 7e 06 00 00    	je     4cb7 <__sprintf_chk@plt+0x2547>  // gvar_9468=0  --> je 4690 || jmpq 4653
    4639:	41 8b 75 50          	mov    0x50(%r13),%esi          // esi=current->argc
    463d:	85 f6                	test   %esi,%esi
    463f:	0f 88 c0 03 00 00    	js     4a05 <__sprintf_chk@plt+0x2295>*/// current->argc < 0    --> fun_3f90(')')
    if ((swapped && gvar_9468 && current->argc < 0) || (!swapped && info))
        fun_3f90(')');

    /*4645:	41 f6 85 a0 00 00 00 	testb  $0x1,0xa0(%r13)          // current->flags & 0x1
    464c:	01 
    464d:	0f 84 de 03 00 00    	je     4a31 <__sprintf_chk@plt+0x22c1>

    4653:	48 8d 3d a1 1b 00 00 	lea    0x1ba1(%rip),%rdi        # 61fb <_IO_stdin_used@@Base+0x1fb> // me
    465a:	31 f6                	xor    %esi,%esi                // esi=0
    465c:	e8 0f e0 ff ff       	callq  2670 <tgetstr@plt>       // tmp=tgetstr(rdi, NULL)
    4661:	48 89 c7             	mov    %rax,%rdi                // rdi=tmp
    4664:	48 85 c0             	test   %rax,%rax                // tmp ?= 0
    4667:	0f 84 b0 03 00 00    	je     4a1d <__sprintf_chk@plt+0x22ad>
    466d:	48 8b 15 5c 49 00 00 	mov    0x495c(%rip),%rdx        # 8fd0 <putchar@GLIBC_2.2.5>        // putchar
    4674:	be 01 00 00 00       	mov    $0x1,%esi                // esi=1
    4679:	e8 92 dd ff ff       	callq  2410 <tputs@plt>*/       // tputs(tmp, 1, putchar)
    if ((current->flags & 0x01) && (tmp = tgetstr("me", NULL)))
        tputs(tmp, 1, putchar);

    /*467e:	44 8b 15 e3 4d 00 00 	mov    0x4de3(%rip),%r10d        # 9468 <stderr@@GLIBC_2.2.5+0x48>  // gvar_9468
    4685:	45 85 d2             	test   %r10d,%r10d              // je 4690
    4688:	0f 85 9f 03 00 00    	jne    4a2d <__sprintf_chk@plt+0x22bd>*/ // --> jmpq 46e8
    if (gvar_9468) {
        // jne 4a2d
        for (i = 0; i < current->argc; i++) {
            if (i < current->argc - 1) {
                // jg 4ac4
                fun_3f90(' ');
            }

            len = 0; 

            for (here = current->argv[i]; *here; here++) {
                len += *here >= ' ' && *here <= '~' ? 1 : 4;
            }

            if (gvar_92c0 + len <= gvar_92c4 - (i == current->argc - 1 ? 0 : 4) || !gvar_92c8)
                fun_4110(current->argv[i]);
            else {
                // jne 4d90
                out_string("...");
                break;
            }
        }
    }
    
    /*468e:	66 90                	xchg   %ax,%ax    
    4690:	44 8b 0d 99 4d 00 00 	mov    0x4d99(%rip),%r9d        # 9430 <stderr@@GLIBC_2.2.5+0x10>   // gvar_9430
    4697:	45 85 c9             	test   %r9d,%r9d
    469a:	74 27                	je     46c3 <__sprintf_chk@plt+0x1f53>*/
        if (gvar_9430 != 0) {

    /*469c:	b8 1b 00 00 00       	mov    $0x1b,%eax               // eax=0x1b=27='\033'
    46a1:	48 8d 1d 45 1a 00 00 	lea    0x1a45(%rip),%rbx        # 60ed <_IO_stdin_used@@Base+0xed>  // str="\033[0m"
    46a8:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
    46af:	00 
    46b0:	0f be f8             	movsbl %al,%edi                 // edi=eax=al
    46b3:	48 83 c3 01          	add    $0x1,%rbx                // str++
    46b7:	e8 d4 f8 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    46bc:	0f b6 03             	movzbl (%rbx),%eax              // eax=*str
    46bf:	84 c0                	test   %al,%al                  // *str ?= NULL
    46c1:	75 ed                	jne    46b0 <__sprintf_chk@plt+0x1f40>*/
            char *str = "\033[0m";
            while (*str) fun_3f90(*str++);
        }

    /*46c3:	8b 05 77 4d 00 00    	mov    0x4d77(%rip),%eax        # 9440 <stderr@@GLIBC_2.2.5+0x20>   // gvar_9440
    46c9:	0b 05 99 4d 00 00    	or     0x4d99(%rip),%eax        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468
    46cf:	0f 85 1b 04 00 00    	jne    4af0 <__sprintf_chk@plt+0x2380>      // --> jmp 46e8
    46d5:	49 83 bd b0 00 00 00 	cmpq   $0x0,0xb0(%r13)          // current->children ?= NULL
    46dc:	00 
    46dd:	0f 84 0d 04 00 00    	je     4af0 <__sprintf_chk@plt+0x2380>      // --> jmp 46e8
    46e3:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)*/
    if (gvar_9440 || gvar_9468 || current->children == NULL) {
        // je 4af0
        while (closing--)
            fun_3f90(']');
         fun_4210();
    }

    /*46e8:	8b 05 92 4d 00 00    	mov    0x4d92(%rip),%eax        # 9480 <stderr@@GLIBC_2.2.5+0x60>   // eax=gvar_9480
    46ee:	4c 8b 3d 83 4d 00 00 	mov    0x4d83(%rip),%r15        # 9478 <stderr@@GLIBC_2.2.5+0x58>   // r15=gvar_9478
    46f5:	39 44 24 0c          	cmp    %eax,0xc(%rsp)                       // gvar_9480 ?= level
    46f9:	0f 8c 41 04 00 00    	jl     4b40 <__sprintf_chk@plt+0x23d0>*/    // level < gvar_9480 --> rax= gvar_9470 --> jmpq 4757
    if (level >= gvar_9480) {
    
    /*46ff:	85 c0                	test   %eax,%eax                        // gvar_9480 ?= 0
    4701:	0f 84 df 05 00 00    	je     4ce6 <__sprintf_chk@plt+0x2576>*/// gvar_9480=0
        if (gvar_9480 == 0) {
            // je 4ce6
            gvar_9480 = 0x64;   // 100
        } 
        else {

    /*4707:	01 c0                	add    %eax,%eax*/              // eax=gvar_9480+gvar_9480
            gvar_9480 *= 2;
        }

    /*4709:	48 63 f0             	movslq %eax,%rsi                // rsi=gvar_9480
    470c:	48 8d 1c b5 00 00 00 	lea    0x0(,%rsi,4),%rbx        // rbx=gvar_9480*4
    4713:	00 
    4714:	4c 89 ff             	mov    %r15,%rdi                // rdi=gvar_9478
    4717:	48 89 de             	mov    %rbx,%rsi                // rsi=gvar_9480*4
    471a:	89 05 60 4d 00 00    	mov    %eax,0x4d60(%rip)        # 9480 <stderr@@GLIBC_2.2.5+0x60>   // gvar_9480
    4720:	e8 5b df ff ff       	callq  2680 <realloc@plt>
    4725:	48 89 05 4c 4d 00 00 	mov    %rax,0x4d4c(%rip)        # 9478 <stderr@@GLIBC_2.2.5+0x58>   // gvar_9478
    472c:	49 89 c7             	mov    %rax,%r15                // r15=gvar_9478
    472f:	48 85 c0             	test   %rax,%rax
    4732:	0f 84 21 07 00 00    	je     4e59 <__sprintf_chk@plt+0x26e9>*/  // perror, exit
        if (!(gvar_9478 = realloc(gvar_9478, gvar_9480 * sizeof(int)))) {
            perror("realloc");
            exit(1);
        }

    /*4738:	48 8b 3d 31 4d 00 00 	mov    0x4d31(%rip),%rdi        # 9470 <stderr@@GLIBC_2.2.5+0x50>   // gvar_9470
    473f:	48 89 de             	mov    %rbx,%rsi                // rsi=gvar_9480*4
    4742:	e8 39 df ff ff       	callq  2680 <realloc@plt>
    4747:	48 89 05 22 4d 00 00 	mov    %rax,0x4d22(%rip)        # 9470 <stderr@@GLIBC_2.2.5+0x50>   // gvar_9470
    474e:	48 85 c0             	test   %rax,%rax
    4751:	0f 84 02 07 00 00    	je     4e59 <__sprintf_chk@plt+0x26e9>*/    // perror, exit
        if (!(gvar_9470 = realloc(gvar_9470, gvar_9480 * sizeof(int)))) {
            perror("realloc");
            exit(1);
        }
    }

    /*4757:	8b 4c 24 10          	mov    0x10(%rsp),%ecx          // ecx=(rsp+0x10)=last
    475b:	48 63 54 24 0c       	movslq 0xc(%rsp),%rdx           // rdx=(rsp+0xc)=level
    4760:	83 f1 01             	xor    $0x1,%ecx                // ecx=!last
    4763:	89 0c 90             	mov    %ecx,(%rax,%rdx,4)       // gvar_9470[level] = !last
    4766:	49 8d 04 97          	lea    (%r15,%rdx,4),%rax*/     // rax=gvar_9470[level]
    gvar_9470[level] = !last;

    /*476a:	8b 15 d0 4c 00 00    	mov    0x4cd0(%rip),%edx        # 9440 <stderr@@GLIBC_2.2.5+0x20>   // gvar_9440
    4770:	0b 15 f2 4c 00 00    	or     0x4cf2(%rip),%edx        # 9468 <stderr@@GLIBC_2.2.5+0x48>   // gvar_9468
    4776:	0f 85 b1 00 00 00    	jne    482d <__sprintf_chk@plt+0x20bd>*/    // --> 48b0 --> return
    if (gvar_9440 || gvar_9468) {
        // jne 482d
        gvar_9470[level] = swapped + (comm_len > 1 ? 0 : -1);
        count = 0;

        for (walk = current->children; walk; walk = next) {
            next = walk->next;
            if (gvar_92cc && walk->child->flags & 0x2) {
                // jne 4b55
                scan = &walk->next;
                while (*scan) {     // *scan == walk->next
                    if (!fun_4270(walk->child, (*scan)->child)) {
                        // je 4b78
                        scan = &(*scan)->next;    // scan=&walk->next->next
                    }
                    else {
                        if (next == *scan)
                            next = (*scan)->next;
                        first++;
                        tmp_child = (*scan)->next;
                        free(*scan);
                        count = first;
                     }
                }   // while (*scan)

                fun_4340(walk->child, level + 1, count + 1, 0, !next, current->uid, closing+ (count ? 2 : 1));
            }
            else { 
                fun_4340(walk->child, level + 1, 1, 0, !walk->next, current->uid, 0);
            }
        }
    }

    /*477c:	8b 15 3e 4b 00 00    	mov    0x4b3e(%rip),%edx        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0
    4782:	41 01 d6             	add    %edx,%r14d               // r14d=gvar_92c0+comm_len
    4785:	44 2b 74 24 18       	sub    0x18(%rsp),%r14d         // r14d=(gvar_92c0+comm_len)-(rsp+0x18)=rep
    478a:	45 01 f4             	add    %r14d,%r12d              // r12d=add+r14d
    478d:	3b 15 31 4b 00 00    	cmp    0x4b31(%rip),%edx        # 92c4 <_IO_stdin_used@@Base+0x32c4>    // gvar_92c4?=gvar_92c0
    4793:	44 89 20             	mov    %r12d,(%rax)             // gvar_9470[level]=r12d
    4796:	0f 8d 87 05 00 00    	jge    4d23 <__sprintf_chk@plt+0x25b3>*/  // gvar_92c4 >= gvar_92c0     // && gvar_92c8 --> je 479c
    gvar_9470[level] = comm_len + gvar_92c0 - rep + add;
    if (gvar_92c4 >= gvar_92c0 && gvar_92c8) {
        out_string(shape_pointer->six);
        fun_3f90('+');
        fun_4210();
        return;
    }

    /*479c:	49 8b 9d b0 00 00 00 	mov    0xb0(%r13),%rbx          // rbx=walk=current->children
    47a3:	48 85 db             	test   %rbx,%rbx
    47a6:	0f 84 04 01 00 00    	je     48b0 <__sprintf_chk@plt+0x2140>*/  // 结束此函数   current->children = NULL
    first = 1;
    for (walk = current->children; walk; walk = next) {

    /*47ac:	83 44 24 0c 01       	addl   $0x1,0xc(%rsp)           // (rsp+0xc)=level+1
    47b1:	c7 44 24 10 01 00 00 	movl   $0x1,0x10(%rsp)          // (rsp+0x10)=first=1
    47b8:	00 
    47b9:	8b 2d 0d 4b 00 00    	mov    0x4b0d(%rip),%ebp        # 92cc <_IO_stdin_used@@Base+0x32cc>    // gvar_92cc
    47bf:	4c 8b 7b 08          	mov    0x8(%rbx),%r15*/         // r15=next=current->children->next=walk->next
        next = walk->next;
        count = 0;  // 4c0a

    /*47c3:	41 be 01 00 00 00    	mov    $0x1,%r14d               // first=0x1
    47c9:	44 8b 64 24 08       	mov    0x8(%rsp),%r12d          // (rsp+0x8)=closing
    47ce:	85 ed                	test   %ebp,%ebp                // gvar_92cc?=0
    47d0:	0f 85 27 04 00 00    	jne    4bfd <__sprintf_chk@plt+0x248d>*/  // gvar_92cc!=0
        if (gvar_92cc) {
            // jne 4bfd
            scan = &walk->next;            
            while (*scan) {     // *scan == walk->next
                if (!fun_4270(walk->child, (*scan)->child)) {
                    // je 4c18
                    scan = &(*scan)->next;      // ==> scan = &walk->next->next;
                }
                else {
                    if (next == *scan)          // *scan = walk->next
                        next = (*scan)->next;
                    tmp_child = (*scan)->next;
                    free(*scan);
                    *scan = tmp_child;
                }
            }
        }

    /*47d6:	44 8b 5c 24 10       	mov    0x10(%rsp),%r11d         // r11d=(rsp+0x10)=first
    47db:	45 85 db             	test   %r11d,%r11d              // first?=0
    47de:	0f 85 91 04 00 00    	jne    4c75 <__sprintf_chk@plt+0x2505>*/  // first!=0
        if (first) {
            // jne 4c75 --> jmpq 47e4
            out_string(next ? shape_pointer->six : shape_pointer->five);
        }

    /*47e4:	45 31 c0             	xor    %r8d,%r8d                // r8d=first=0
    47e7:	4d 85 ff             	test   %r15,%r15                // r15=next?=NULL
    47ea:	45 8b 4d 5c          	mov    0x5c(%r13),%r9d          // r9d=current->uid
    47ee:	44 89 f2             	mov    %r14d,%edx               // edx=count + 1
    47f1:	41 0f 94 c0          	sete   %r8b                     // rb8=!next
    47f5:	31 c9                	xor    %ecx,%ecx                // ecx=0
    47f7:	49 39 9d b0 00 00 00 	cmp    %rbx,0xb0(%r13)          // walk?=current->children
    47fe:	0f 94 c1             	sete   %cl                      // !cl
    4801:	48 83 ec 08          	sub    $0x8,%rsp
    4805:	41 54                	push   %r12                     // r12=closing + (count ? 1 : 0), --> 4c67
    4807:	8b 74 24 1c          	mov    0x1c(%rsp),%esi          // (rsp+0x1c)=0x1c-0x10=(rsp+0xc)==level+1
    480b:	48 8b 3b             	mov    (%rbx),%rdi              // rdi=walk->child
    480e:	e8 2d fb ff ff       	callq  4340 <__sprintf_chk@plt+0x1bd0>*/  // fun_4340
        first = 0;
        fun_4340(walk->child, level + 1, count + 1, walk == current->children, !next, current->uid, closing + (count ? 1 : 0));

    /*4813:	41 59                	pop    %r9
    4815:	41 5a                	pop    %r10
    4817:	4d 85 ff             	test   %r15,%r15                r15=current->children->next?=NULL
    481a:	0f 84 90 00 00 00    	je     48b0 <__sprintf_chk@plt+0x2140>  // 结束此函数
    4820:	c7 44 24 10 00 00 00 	movl   $0x0,0x10(%rsp)          // (rsp+0x10)=last
    4827:	00 
    4828:	4c 89 fb             	mov    %r15,%rbx                // rbx=r15=current->children->next
    482b:	eb 8c                	jmp    47b9 <__sprintf_chk@plt+0x2049>*/
    }
    
    /*482d:	31 d2                	xor    %edx,%edx                // edx=count=0
    482f:	41 83 fe 01          	cmp    $0x1,%r14d               // r14d=comm_len?=1
    4833:	4d 8b b5 b0 00 00 00 	mov    0xb0(%r13),%r14          // r14=walk=current->children
    483a:	0f 9e c2             	setle  %dl
    483d:	29 d5                	sub    %edx,%ebp                // ebp=ebp-edx=swapped-(0|-1)
    483f:	89 28                	mov    %ebp,(%rax)              // gvar_9470[level] = swapped
        gvar_9470[level] = swapped + (comm_len > 1 ? 0 : -1);
        count = 0;

    4841:	4d 85 f6             	test   %r14,%r14                // walk=current->children?=NULL
    4844:	74 6a                	je     48b0 <__sprintf_chk@plt+0x2140>  // 结束此函数
        for (walk = current->children; walk; walk = next) {

    4846:	8b 44 24 0c          	mov    0xc(%rsp),%eax           // (rsp+0xc)=level
    484a:	4c 89 6c 24 10       	mov    %r13,0x10(%rsp)          // (rsp+0x10)=current
    484f:	4d 89 f7             	mov    %r14,%r15                // r15=r14=walk=current->children
    4852:	83 c0 01             	add    $0x1,%eax                // eax=level+1
    4855:	89 44 24 0c          	mov    %eax,0xc(%rsp)           // (rsp+0xc)=level+1
    4859:	8b 35 6d 4a 00 00    	mov    0x4a6d(%rip),%esi        # 92cc <_IO_stdin_used@@Base+0x32cc>    // gvar_92cc
    485f:	4d 8b 6f 08          	mov    0x8(%r15),%r13           // r13=next=walk->next
    4863:	4d 8b 37             	mov    (%r15),%r14              // r14 = current->children->child = walk->child
            next = walk->next;

    4866:	85 f6                	test   %esi,%esi                // gvar_92cc?=0           
    4868:	74 0e                	je     4878 <__sprintf_chk@plt+0x2108>  // gvar_92cc=0
    486a:	41 f6 86 a0 00 00 00 	testb  $0x2,0xa0(%r14)          // r14=walk->flags?=2
    4871:	02 
    4872:	0f 85 dd 02 00 00    	jne    4b55 <__sprintf_chk@plt+0x23e5>  // !=   --> jmpq 48ab
            if (gvar_92cc && walk->child->flags & 0x2) {
                // jne 4b55
            }
            else {            

    4878:	48 8b 44 24 10       	mov    0x10(%rsp),%rax          // rax=(rsp+0x10)=current
    487d:	45 31 c0             	xor    %r8d,%r8d                // r8d=0
    4880:	4d 85 ed             	test   %r13,%r13                // r13=walk->next?=NULL
    4883:	4c 89 f7             	mov    %r14,%rdi                // rdi=walk->child
    4886:	41 0f 94 c0          	sete   %r8b                     // r8b=!walk->next
    488a:	48 83 ec 08          	sub    $0x8,%rsp                // rsp=rsp-0x8
    488e:	31 c9                	xor    %ecx,%ecx                // ecx=0
    4890:	ba 01 00 00 00       	mov    $0x1,%edx                // edx=1
    4895:	44 8b 48 5c          	mov    0x5c(%rax),%r9d          // r9d=current->uid
    4899:	6a 00                	pushq  $0x0
    489b:	8b 74 24 1c          	mov    0x1c(%rsp),%esi              // (rsp+0x1c)=0x1c-0x10=0xc --> esi=(rsp+0xc)=level+1
    489f:	e8 9c fa ff ff       	callq  4340 <__sprintf_chk@plt+0x1bd0>  // fun_4340                
                fun_4340(walk->child, level + 1, 1, 0, !walk->next, current->uid, 0);
            }   // else if (gvar_92cc && walk->child->flags & 0x2)

    48a4:	41 5e                	pop    %r14
    48a6:	41 5f                	pop    %r15
    48a8:	4d 89 ef             	mov    %r13,%r15                // r15=current->children=r13=current->children->next
    48ab:	4d 85 ff             	test   %r15,%r15                // current->children?=NULL
    48ae:	75 a9                	jne    4859 <__sprintf_chk@plt+0x20e9>  // !=
    }   // for (walk = current->children; walk; walk = next)

    48b0:	48 83 c4 28          	add    $0x28,%rsp
    48b4:	5b                   	pop    %rbx
    48b5:	5d                   	pop    %rbp
    48b6:	41 5c                	pop    %r12
    48b8:	41 5d                	pop    %r13
    48ba:	41 5e                	pop    %r14
    48bc:	41 5f                	pop    %r15
    48be:	c3                   	retq   
    return;

    48bf:	90                   	nop*/
}

    /*48c0:	4c 89 ef             	mov    %r13,%rdi        // rdi=r13=current
    48c3:	e8 48 f8 ff ff       	callq  4110 <__sprintf_chk@plt+0x19a0>  // fun_4110(current->comm)
    48c8:	8b 35 92 4b 00 00    	mov    0x4b92(%rip),%esi        # 9460 <stderr@@GLIBC_2.2.5+0x40>       // gvar_9460
    48ce:	41 89 c6             	mov    %eax,%r14d       // comm_len = fun_4110(current->comm)
    comm_len = fun_4110(current->comm);

    48d1:	8b 05 e9 49 00 00    	mov    0x49e9(%rip),%eax        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0
    48d7:	89 44 24 18          	mov    %eax,0x18(%rsp)          // rep=gvar_92c0
    rep = gvar_92c0;

    48db:	85 f6                	test   %esi,%esi
    48dd:	0f 84 12 04 00 00    	je     4cf5 <__sprintf_chk@plt+0x2585>
    if (gvar_9460 == 0) {
        // je 4cf5
        info = gvar_945c;
        if (gvar_945c == 0) {
            je 44b0
        }
        info = 0x1;
        fun_3f90('(');
        fun_4060(current->pgid);
        // jmpq 44b0
    }

    48e3:	bf 28 00 00 00       	mov    $0x28,%edi           // edi=0x28='('
    48e8:	41 bf 01 00 00 00    	mov    $0x1,%r15d           // r15d=info=0x1
    48ee:	e8 9d f6 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>      // fun_3f90(const char ch)
    fun_3f90('(');
    48f3:	41 8b 7d 54          	mov    0x54(%r13),%edi                      // edi=current->pid
    48f7:	e8 64 f7 ff ff       	callq  4060 <__sprintf_chk@plt+0x18f0>      // fun_4060(current->pid)
    fun_4060(current->pid);
    48fc:	8b 05 5a 4b 00 00    	mov    0x4b5a(%rip),%eax        # 945c <stderr@@GLIBC_2.2.5+0x3c>   // gvar_945c
    4902:	85 c0                	test   %eax,%eax
    4904:	0f 84 a6 fb ff ff    	je     44b0 <__sprintf_chk@plt+0x1d40>
    if (gvar_945c == 0) {
        // je 44b0
    }
    490a:	41 bf 02 00 00 00    	mov    $0x2,%r15d   // r15d=0x2
    4910:	bf 2c 00 00 00       	mov    $0x2c,%edi   // edi=0x2c=','
    4915:	e9 f6 03 00 00       	jmpq   4d10 <__sprintf_chk@plt+0x25a0>
    fun_3f90(',');
    fun_4060(current->pgid);
    // jmpq 44b0

    491a:	8b 7c 24 18          	mov    0x18(%rsp),%edi          // edi=rep
    491e:	48 8d 1d c1 17 00 00 	lea    0x17c1(%rip),%rbx        # 60e6 <_IO_stdin_used@@Base+0xe6>  // "*["
    4925:	e8 36 f7 ff ff       	callq  4060 <__sprintf_chk@plt+0x18f0>
    492a:	44 8d 60 02          	lea    0x2(%rax),%r12d          // add = fun_4060(rep) + 2;
    492e:	b8 2a 00 00 00       	mov    $0x2a,%eax               // eax='*'
    4933:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
    4938:	0f be f8             	movsbl %al,%edi
    493b:	48 83 c3 01          	add    $0x1,%rbx
    493f:	e8 4c f6 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    4944:	0f b6 03             	movzbl (%rbx),%eax
    4947:	84 c0                	test   %al,%al
    4949:	75 ed                	jne    4938 <__sprintf_chk@plt+0x21c8>
    494b:	83 3d de 4a 00 00 01 	cmpl   $0x1,0x4ade(%rip)        # 9430 <stderr@@GLIBC_2.2.5+0x10>   // gvar_9430
    4952:	0f 85 e3 fa ff ff    	jne    443b <__sprintf_chk@plt+0x1ccb>
    
    4958:	8b 05 82 49 00 00    	mov    0x4982(%rip),%eax        # 92e0 <age_to_color@@Base>     // eax=gvar_92e0
    495e:	48 8d 15 7b 49 00 00 	lea    0x497b(%rip),%rdx        # 92e0 <age_to_color@@Base>     // rdx=*p=&gvar_g2e0
    4965:	85 c0                	test   %eax,%eax                // p ?= 0
    4967:	74 1e                	je     4987 <__sprintf_chk@plt+0x2217>
    4969:	f2 41 0f 2c 8d a8 00 	cvttsd2si 0xa8(%r13),%ecx       // ecx=current->age, 将截断双精度浮点值转换为有符号整数
    4970:	00 00 
    4972:	eb 0f                	jmp    4983 <__sprintf_chk@plt+0x2213>
    4974:	0f 1f 40 00          	nopl   0x0(%rax)

    4978:	8b 42 10             	mov    0x10(%rdx),%eax          // eax=p->age_seconds
    497b:	48 83 c2 10          	add    $0x10,%rdx               // p++
    497f:	85 c0                	test   %eax,%eax
    4981:	74 04                	je     4987 <__sprintf_chk@plt+0x2217>

    4983:	39 c1                	cmp    %eax,%ecx                // p->age_seconds ?= current->age
    4985:	73 f1                	jae    4978 <__sprintf_chk@plt+0x2208>
    struct age_to_color *p;
    for(p = gvar_g2e0, p->age_seconds != 0; p++) {
        // jae 4978
        if (current->age < p->age_seconds)
            break;
    }

    4987:	48 8b 5a 08          	mov    0x8(%rdx),%rbx           // rbx=*str=p->color
    498b:	0f b6 03             	movzbl (%rbx),%eax              // eax=*str
    498e:	84 c0                	test   %al,%al
    4990:	0f 84 a5 fa ff ff    	je     443b <__sprintf_chk@plt+0x1ccb>
    4996:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    499d:	00 00 00 
    while (*str) {

    49a0:	0f be f8             	movsbl %al,%edi                 // edi=*str
    49a3:	48 83 c3 01          	add    $0x1,%rbx                // *str++
    49a7:	e8 e4 f5 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
        fun_3f90(*str++);
    49ac:	0f b6 03             	movzbl (%rbx),%eax
    49af:	84 c0                	test   %al,%al
    49b1:	75 ed                	jne    49a0 <__sprintf_chk@plt+0x2230>
    }
    
    49b3:	41 f6 85 a0 00 00 00 	testb  $0x1,0xa0(%r13)          // // current->flags & 0x1
    49ba:	01 
    49bb:	0f 84 88 fa ff ff    	je     4449 <__sprintf_chk@plt+0x1cd9>
    if (current->flags == 0x1)
        // je 4449

    49c1:	48 8d 3d 44 17 00 00 	lea    0x1744(%rip),%rdi        # 610c <_IO_stdin_used@@Base+0x10c>
    49c8:	31 f6                	xor    %esi,%esi
    49ca:	e8 a1 dc ff ff       	callq  2670 <tgetstr@plt>       // tgetstr("md", NULL)
    49cf:	48 89 c7             	mov    %rax,%rdi                // tmp=tgetstr("md", NULL)
    49d2:	48 85 c0             	test   %rax,%rax                // tmp ?= NULL
    49d5:	0f 84 6e fa ff ff    	je     4449 <__sprintf_chk@plt+0x1cd9>
    49db:	48 8b 15 ee 45 00 00 	mov    0x45ee(%rip),%rdx        # 8fd0 <putchar@GLIBC_2.2.5>
    49e2:	be 01 00 00 00       	mov    $0x1,%esi
    49e7:	e8 24 da ff ff       	callq  2410 <tputs@plt>         // tputs(tmp, 1, putchar)
    49ec:	e9 58 fa ff ff       	jmpq   4449 <__sprintf_chk@plt+0x1cd9>
    49f1:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)

    49f8:	48 8b 18             	mov    (%rax),%rbx              // rbx=shape_pointer->first
    49fb:	e9 09 fa ff ff       	jmpq   4409 <__sprintf_chk@plt+0x1c99>

    4a00:	45 85 ff             	test   %r15d,%r15d              // r15d=info
    4a03:	74 0a                	je     4a0f <__sprintf_chk@plt+0x229f>
    4a05:	bf 29 00 00 00       	mov    $0x29,%edi               // ')'
    4a0a:	e8 81 f5 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
        fun_3f90(')');

    4a0f:	41 f6 85 a0 00 00 00 	testb  $0x1,0xa0(%r13)          // current->flags & 0x1
    4a16:	01 
    4a17:	0f 85 36 fc ff ff    	jne    4653 <__sprintf_chk@plt+0x1ee3>

    4a1d:	44 8b 15 44 4a 00 00 	mov    0x4a44(%rip),%r10d        # 9468 <stderr@@GLIBC_2.2.5+0x48>  // gvar_9468
    4a24:	45 85 d2             	test   %r10d,%r10d              // gvar_9468 ?= 0
    4a27:	0f 84 63 fc ff ff    	je     4690 <__sprintf_chk@plt+0x1f20>  // gvar_9468=0

    4a2d:	41 8b 75 50          	mov    0x50(%r13),%esi          // esi=current->argc
        for (i = 0; i < current->argc; i++) {

    4a31:	31 db                	xor    %ebx,%ebx                // ebx=i=0
    4a33:	85 f6                	test   %esi,%esi                // esi=current->argc
    4a35:	0f 8e 55 fc ff ff    	jle    4690 <__sprintf_chk@plt+0x1f20>  // <=       break;
    4a3b:	8d 46 ff             	lea    -0x1(%rsi),%eax          // eax=current->argc-1
    4a3e:	41 89 df             	mov    %ebx,%r15d               // r15d=i=0;
    4a41:	39 d8                	cmp    %ebx,%eax                // i, current->argc-1
    4a43:	7f 7f                	jg     4ac4 <__sprintf_chk@plt+0x2354> // current->argc-1 > i
    4a45:	0f 1f 00             	nopl   (%rax)
            if (i < current->argc - 1) {
                // jg 4ac4
                fun_3f90(' ');
            }

            len = 0; 

    4a48:	49 8b 45 48          	mov    0x48(%r13),%rax          // rax=current->argv
    4a4c:	48 8b 3c d8          	mov    (%rax,%rbx,8),%rdi       // rdi=here=current->argv[i]
    4a50:	0f b6 07             	movzbl (%rdi),%eax              // eax=*here=current->argv[i][0]
    4a53:	84 c0                	test   %al,%al                  // al=*here
    4a55:	0f 84 8a 00 00 00    	je     4ae5 <__sprintf_chk@plt+0x2375>  // jmp 4a79
            for (here = current->argv[i]; *here; here++) {

    4a5b:	48 89 fa             	mov    %rdi,%rdx                // rdx=rdi=here=current->argv[i]
    4a5e:	31 c9                	xor    %ecx,%ecx                // ecx=len=0

    4a60:	83 e8 20             	sub    $0x20,%eax               // eax=*here-' '
    4a63:	3c 5f                	cmp    $0x5f,%al                // 0x5f+0x20=0x7f, 即' '到'~'区间的acsii字符。
    4a65:	19 c0                	sbb    %eax,%eax                // eax=0|0xffffffff
    4a67:	48 83 c2 01          	add    $0x1,%rdx                // rdx=here++
    4a6b:	83 e0 fd             	and    $0xfffffffd,%eax         // eax=0|-3
    4a6e:	8d 4c 08 04          	lea    0x4(%rax,%rcx,1),%ecx    // ecx=len=len + 1||4
    4a72:	0f b6 02             	movzbl (%rdx),%eax              // eax=*here
    4a75:	84 c0                	test   %al,%al                  // al ?= 0
    4a77:	75 e7                	jne    4a60 <__sprintf_chk@plt+0x22f0>
                len += *here >= ' ' && *here <= '~' ? 1 : 4;
            }   // for (here = current->argv[i]; *here; here++)

    4a79:	8b 05 45 48 00 00    	mov    0x4845(%rip),%eax        # 92c4 <_IO_stdin_used@@Base+0x32c4>    // gvar_92c4, eax=gvar_92c4
    4a7f:	83 ee 01             	sub    $0x1,%esi                // esi=current->argc-1
    4a82:	03 0d 38 48 00 00    	add    0x4838(%rip),%ecx        # 92c0 <_IO_stdin_used@@Base+0x32c0>    // gvar_92c0, ecx=len+gvar_92c0
    4a88:	44 39 fe             	cmp    %r15d,%esi               // i ?= current->argc-1
    4a8b:	8d 50 fc             	lea    -0x4(%rax),%edx          // edx=gvar_92c4-0x4
    4a8e:	0f 45 c2             	cmovne %edx,%eax                // i!=current->argc-1时，eax=edx=gvar_92c4-0x4, i==current->argc-1时, eax=gvar_92c4
    4a91:	39 c1                	cmp    %eax,%ecx                // len+gvar_92c0 ?= (gvar_92c4 || gvar_92c4-0x4)
    4a93:	7e 10                	jle    4aa5 <__sprintf_chk@plt+0x2335>  // <=
    4a95:	44 8b 05 2c 48 00 00 	mov    0x482c(%rip),%r8d        # 92c8 <_IO_stdin_used@@Base+0x32c8>    // gvar_92c8
    4a9c:	45 85 c0             	test   %r8d,%r8d                // gvar_92c8 ?= 0
    4a9f:	0f 85 eb 02 00 00    	jne    4d90 <__sprintf_chk@plt+0x2620>  // gvar_92c8 != 0       --> jmpq 4690
            if (gvar_92c0 + len <= gvar_92c4 - (i == current->argc - 1 ? 0 : 4) || !gvar_92c8)

    4aa5:	e8 66 f6 ff ff       	callq  4110 <__sprintf_chk@plt+0x19a0>  // fun_4110
                fun_4110(current->argv[i]);
            else {
                // jne 4d90
                out_string("...");
                break;
            }

    4aaa:	41 8b 75 50          	mov    0x50(%r13),%esi          // esi=current->argc
    4aae:	48 83 c3 01          	add    $0x1,%rbx                // i++
    4ab2:	39 de                	cmp    %ebx,%esi                // i < current->argc
    4ab4:	0f 8e d6 fb ff ff    	jle    4690 <__sprintf_chk@plt+0x1f20>  // break;
    4aba:	8d 46 ff             	lea    -0x1(%rsi),%eax          // eax=current->argc-1
    4abd:	41 89 df             	mov    %ebx,%r15d               // r15d=ebx=i
    4ac0:	39 d8                	cmp    %ebx,%eax                // i < current->argc-1
    4ac2:	7e 84                	jle    4a48 <__sprintf_chk@plt+0x22d8>  // <=

    4ac4:	bf 20 00 00 00       	mov    $0x20,%edi
    4ac9:	e8 c2 f4 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    4ace:	49 8b 45 48          	mov    0x48(%r13),%rax          // rax=current->argv
    4ad2:	41 8b 75 50          	mov    0x50(%r13),%esi          // esi=current->argc
    4ad6:	48 8b 3c d8          	mov    (%rax,%rbx,8),%rdi       // rdi=here=current->argv[i]
    4ada:	0f b6 07             	movzbl (%rdi),%eax              // eax=*here=current->argv[i][0]
    4add:	84 c0                	test   %al,%al                  // current->argv[i][0]?=0
    4adf:	0f 85 76 ff ff ff    	jne    4a5b <__sprintf_chk@plt+0x22eb>            

    4ae5:	31 c9                	xor    %ecx,%ecx                // ecx=len=0
    4ae7:	eb 90                	jmp    4a79 <__sprintf_chk@plt+0x2309>
        }   // for (i = 0; i < current->argc; i++)

    4ae9:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    4af0:	8b 44 24 08          	mov    0x8(%rsp),%eax           // eax=(rsp+0x8)=closing
    4af4:	8d 58 ff             	lea    -0x1(%rax),%ebx          // ebx=closing--
    4af7:	85 c0                	test   %eax,%eax                // closing ?= 0
        while (closing--)
    4af9:	74 17                	je     4b12 <__sprintf_chk@plt+0x23a2>
    4afb:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
    4b00:	bf 5d 00 00 00       	mov    $0x5d,%edi               // edi=']'
    4b05:	83 eb 01             	sub    $0x1,%ebx
    4b08:	e8 83 f4 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>      // fun_3f90(const char ch)
            fun_3f90(']');
    4b0d:	83 fb ff             	cmp    $0xffffffff,%ebx         // closing ?= -1
    4b10:	75 ee                	jne    4b00 <__sprintf_chk@plt+0x2390>           
    4b12:	e8 f9 f6 ff ff       	callq  4210 <__sprintf_chk@plt+0x1aa0>      // fun_4210()
         fun_4210();

    4b17:	c7 44 24 08 ff ff ff 	movl   $0xffffffff,0x8(%rsp)                // closing=-1
    4b1e:	ff 
    4b1f:	e9 c4 fb ff ff       	jmpq   46e8 <__sprintf_chk@plt+0x1f78>
    4b24:	0f 1f 40 00          	nopl   0x0(%rax)

    4b28:	8b 4c 24 10          	mov    0x10(%rsp),%ecx      // ecx=(rsp+0x10)=last
    4b2c:	85 c9                	test   %ecx,%ecx            // last ?= 0
    4b2e:	74 1c                	je     4b4c <__sprintf_chk@plt+0x23dc>  // rbx=shape_pointer->second
    4b30:	48 8b 58 18          	mov    0x18(%rax),%rbx      // rbx=shape_pointer->four
    4b34:	e9 d0 f8 ff ff       	jmpq   4409 <__sprintf_chk@plt+0x1c99>
    4b39:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)

    4b40:	48 8b 05 29 49 00 00 	mov    0x4929(%rip),%rax        # 9470 <stderr@@GLIBC_2.2.5+0x50>   // rax=gvar_9470
    4b47:	e9 0b fc ff ff       	jmpq   4757 <__sprintf_chk@plt+0x1fe7>

    4b4c:	48 8b 58 08          	mov    0x8(%rax),%rbx       // rbx=shape_pointer->second
    4b50:	e9 b4 f8 ff ff       	jmpq   4409 <__sprintf_chk@plt+0x1c99>
        last ? (shape_pointer->four):(shape_pointer->second)

    4b55:	4d 8d 67 08          	lea    0x8(%r15),%r12       // r12=scan=&walk->next
        scan = &walk->next;

    4b59:	4d 85 ed             	test   %r13,%r13            // r13=walk->next
    4b5c:	0f 84 93 02 00 00    	je     4df5 <__sprintf_chk@plt+0x2685>
        while (*scan) {     // *scan == walk->next

    4b62:	c7 44 24 18 00 00 00 	movl   $0x0,0x18(%rsp)      // (rsp+0x18)=0
    4b69:	00 
    4b6a:	4c 89 ed             	mov    %r13,%rbp            // rbp=walk->next
    4b6d:	bb 01 00 00 00       	mov    $0x1,%ebx            // ebx=first=1
    4b72:	eb 0f                	jmp    4b83 <__sprintf_chk@plt+0x2413>
    4b74:	0f 1f 40 00          	nopl   0x0(%rax)

    4b78:	4c 8d 67 08          	lea    0x8(%rdi),%r12       // r12=scan=&(*scan)->next, scan=&walk->next->next
    4b7c:	89 da                	mov    %ebx,%edx            // edx=count=first
    4b7e:	4d 85 ed             	test   %r13,%r13
    4b81:	74 38                	je     4bbb <__sprintf_chk@plt+0x244b>

    4b83:	49 8b 75 00          	mov    0x0(%r13),%rsi       // rsi=walk->next->child
    4b87:	4c 89 f7             	mov    %r14,%rdi            // rdi=walk->child
    4b8a:	e8 e1 f6 ff ff       	callq  4270 <__sprintf_chk@plt+0x1b00>
    4b8f:	4c 89 ef             	mov    %r13,%rdi            // rdi=r13=walk->next, rdi=r13=*scan
    4b92:	4d 8b 6d 08          	mov    0x8(%r13),%r13       // r13=walk->next->next, r13=(*scan)->next
    4b96:	85 c0                	test   %eax,%eax
    4b98:	74 de                	je     4b78 <__sprintf_chk@plt+0x2408>
            if (!fun_4270(walk->child, (*scan)->child)) {
                // je 4b78
                scan = &(*scan)->next;    // scan=&walk->next->next
            }
            else {

    4b9a:	48 39 ef             	cmp    %rbp,%rdi            // rbp=next, rdi = *scan = walk->next
    4b9d:	89 5c 24 18          	mov    %ebx,0x18(%rsp)      // (rsp+0x18)=count=ebx=first
    4ba1:	49 0f 44 ed          	cmove  %r13,%rbp            // rbp=next=(*scan)->next
                if (next == *scan)
                    next = (*scan)->next;

    4ba5:	83 c3 01             	add    $0x1,%ebx            // ebx=first+1
    4ba8:	e8 53 d8 ff ff       	callq  2400 <free@plt>
                first++;
                tmp_child = (*scan)->next;
                free(*scan);

    4bad:	4d 89 2c 24          	mov    %r13,(%r12)          // *scan=(*scan)->next
                *scan = tmp_child;

    4bb1:	4d 8b 37             	mov    (%r15),%r14          // r14=walk->child=walk->child
    4bb4:	89 da                	mov    %ebx,%edx            // edx=count=first+1
                count = first;

    4bb6:	4d 85 ed             	test   %r13,%r13
    4bb9:	75 c8                	jne    4b83 <__sprintf_chk@plt+0x2413>
            }
        }   // while (*scan)

    4bbb:	8b 4c 24 18          	mov    0x18(%rsp),%ecx      // ecx=count
    4bbf:	31 c0                	xor    %eax,%eax            // eax=0
    4bc1:	85 c9                	test   %ecx,%ecx            // ecx?=count
    4bc3:	0f 95 c0             	setne  %al                  // !al
    4bc6:	83 c0 01             	add    $0x1,%eax            // eax=(0|1)+1 = 1|2
    4bc9:	45 31 c0             	xor    %r8d,%r8d            // r8d=0
    4bcc:	48 85 ed             	test   %rbp,%rbp            // next?=NULL
    4bcf:	48 8b 74 24 10       	mov    0x10(%rsp),%rsi      // rsi=current
    4bd4:	4c 89 f7             	mov    %r14,%rdi            // rdi=r14=walk->child
    4bd7:	41 0f 94 c0          	sete   %r8b                 // !next
    4bdb:	48 83 ec 08          	sub    $0x8,%rsp            // rsp=rsp-0x8
    4bdf:	31 c9                	xor    %ecx,%ecx            // ecx=0
    4be1:	49 89 ef             	mov    %rbp,%r15            // r15=next
    4be4:	03 44 24 10          	add    0x10(%rsp),%eax      // (rsp+0x10)=0x10-0x8=0x8 --> eax=(rsp+0x8)=closing+(2|1)
    4be8:	44 8b 4e 5c          	mov    0x5c(%rsi),%r9d      // r9d=current->uid
    4bec:	50                   	push   %rax                 // rax=closing
    4bed:	8b 74 24 1c          	mov    0x1c(%rsp),%esi      // (rsp+0x1c)=0x1c-0x10=0xc --> esi=(rsp+0xc)=level+1
    4bf1:	e8 4a f7 ff ff       	callq  4340 <__sprintf_chk@plt+0x1bd0>  // fun_4340
        fun_4340(walk->child, level + 1, count + 1, 0, !next, current->uid, closing+ (count ? 2 : 1));

    4bf6:	58                   	pop    %rax
    4bf7:	5a                   	pop    %rdx
    4bf8:	e9 ae fc ff ff       	jmpq   48ab <__sprintf_chk@plt+0x213b>

    4bfd:	4c 8d 73 08          	lea    0x8(%rbx),%r14       // r14=scan=&current->children->next=&walk->next
        scan = &walk->next;
        count = 0;          // 4c0a

    4c01:	4d 85 ff             	test   %r15,%r15            // r15=next=current->children->next=walk->next
    4c04:	0f 84 fc 01 00 00    	je     4e06 <__sprintf_chk@plt+0x2696>
        while (*sacn) {     // *scan == walk->next

    4c0a:	45 31 e4             	xor    %r12d,%r12d          // r12d=count=0
    4c0d:	4c 89 fd             	mov    %r15,%rbp            // rbp=r15=next
    4c10:	eb 0f                	jmp    4c21 <__sprintf_chk@plt+0x24b1>
    4c12:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
    4c18:	4c 8d 77 08          	lea    0x8(%rdi),%r14       // r14=scan=&walk->next->next=&(*scan)->next
    4c1c:	4d 85 ff             	test   %r15,%r15            // r15=walk->next
    4c1f:	74 2e                	je     4c4f <__sprintf_chk@plt+0x24df>

    4c21:	49 8b 37             	mov    (%r15),%rsi          // rsi=walk->next->child=(*scan)->child
    4c24:	48 8b 3b             	mov    (%rbx),%rdi          // rdi=walk->child
    4c27:	e8 44 f6 ff ff       	callq  4270 <__sprintf_chk@plt+0x1b00>  // fun_4270(walk->child, (*scan)->child))
    4c2c:	4c 89 ff             	mov    %r15,%rdi            // rdi=walk->next
    4c2f:	4d 8b 7f 08          	mov    0x8(%r15),%r15       // r15=walk->next->next
    4c33:	85 c0                	test   %eax,%eax         
    4c35:	74 e1                	je     4c18 <__sprintf_chk@plt+0x24a8>
            if (!fun_4270(walk->child, (*scan)->child)) {
                // je 4c18
                scan = &(*scan)->next;      // ==> scan = &walk->next->next;
            }
            else {
    4c37:	48 39 fd             	cmp    %rdi,%rbp            // rdi=walk->next, rbp=next
    4c3a:	49 0f 44 ef          	cmove  %r15,%rbp            // r15=walk->next->next, rbp=next
                if (next == *scan)          // *scan = walk->next
                    next = (*scan)->next;

    4c3e:	41 83 c4 01          	add    $0x1,%r12d           // count++
                count++

    4c42:	e8 b9 d7 ff ff       	callq  2400 <free@plt>
                tmp_child = (*scan)->next;
                free(*scan);

    4c47:	4d 89 3e             	mov    %r15,(%r14)          // *scan=(*scan)->next
                *scan = tmp_child;

    4c4a:	4d 85 ff             	test   %r15,%r15
    4c4d:	75 d2                	jne    4c21 <__sprintf_chk@plt+0x24b1>      // while (*sacn)
            }
        }       // while (*sacn) {     // *scan == walk->next

    4c4f:	45 85 e4             	test   %r12d,%r12d          // count ?= 0
    4c52:	44 8b 5c 24 10       	mov    0x10(%rsp),%r11d     // r11d=last
    4c57:	45 8d 74 24 01       	lea    0x1(%r12),%r14d      // r14d=count+1
    4c5c:	49 89 ef             	mov    %rbp,%r15            // r15=next
    4c5f:	41 0f 95 c4          	setne  %r12b                // count ? 1:0
    4c63:	45 0f b6 e4          	movzbl %r12b,%r12d          // count=count
    4c67:	44 03 64 24 08       	add    0x8(%rsp),%r12d      // r12d=closing + (count ? 1 : 0)
    4c6c:	45 85 db             	test   %r11d,%r11d          // last?=0
    4c6f:	0f 84 6f fb ff ff    	je     47e4 <__sprintf_chk@plt+0x2074>
        if (last == 0) {
            // je 47e4
        }

    4c75:	48 8b 05 94 46 00 00 	mov    0x4694(%rip),%rax        # 9310 <age_to_color@@Base+0x30>    // 9310=shape_pointer
    4c7c:	4d 85 ff             	test   %r15,%r15                // r15=shape_pointer?=NULL
    4c7f:	0f 84 53 01 00 00    	je     4dd8 <__sprintf_chk@plt+0x2668>  // ==
        if (shape_pointer == NULL) {
            // je 4dd8
            // rbp=shape_pointer->five
            // r15d = 0         // r15=next=current->children->next=walk->next
            // jmpq 4c89
        }

    4c85:	48 8b 68 28          	mov    0x28(%rax),%rbp          // (rsp+0x28)=shape_pointer->six
    4c89:	0f be 7d 00          	movsbl 0x0(%rbp),%edi           // edi=shape_pointer->five||shape_pointer->six[0]
    4c8d:	40 84 ff             	test   %dil,%dil
    4c90:	0f 84 4e fb ff ff    	je     47e4 <__sprintf_chk@plt+0x2074>
    4c96:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    4c9d:	00 00 00 
    4ca0:	e8 eb f2 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>    // fun_3f90(const char ch)
    4ca5:	0f be 7d 01          	movsbl 0x1(%rbp),%edi
    4ca9:	48 83 c5 01          	add    $0x1,%rbp
    4cad:	40 84 ff             	test   %dil,%dil
    4cb0:	75 ee                	jne    4ca0 <__sprintf_chk@plt+0x2530>
    4cb2:	e9 2d fb ff ff       	jmpq   47e4 <__sprintf_chk@plt+0x2074>
        out_string(next ? shape_pointer->six : shape_pointer->five);

    4cb7:	41 f6 85 a0 00 00 00 	testb  $0x1,0xa0(%r13)          // current->flags & 0x1
    4cbe:	01 
    4cbf:	0f 84 cb f9 ff ff    	je     4690 <__sprintf_chk@plt+0x1f20>
    4cc5:	e9 89 f9 ff ff       	jmpq   4653 <__sprintf_chk@plt+0x1ee3>

    4cca:	8b 0d 8c 47 00 00    	mov    0x478c(%rip),%ecx        # 945c <stderr@@GLIBC_2.2.5+0x3c>   // ecx=gvar_945c
    4cd0:	41 89 ef             	mov    %ebp,%r15d               // info=r15d=ebp=swapped
    4cd3:	85 c9                	test   %ecx,%ecx                // gvar_945c ?= 0
    4cd5:	0f 84 d5 f7 ff ff    	je     44b0 <__sprintf_chk@plt+0x1d40>
    if (gvar_945c == 0) {
        // je 44b0
        // 此处可忽略，因会顺利执行到 44b0
    }
    else {
        fun_3f90(',');
        fun_4060(current->pgid);
        // jmpq 44b0
    }
    
    4cdb:	44 8d 7d 01          	lea    0x1(%rbp),%r15d          // r15d=info+1
    4cdf:	bf 2c 00 00 00       	mov    $0x2c,%edi               // edi=0x2c=','
    4ce4:	eb 2a                	jmp    4d10 <__sprintf_chk@plt+0x25a0>  // fun_3f90(',');

    4ce6:	bb 90 01 00 00       	mov    $0x190,%ebx              // ebx=0x190
    4ceb:	b8 64 00 00 00       	mov    $0x64,%eax               // eax=0x64
    4cf0:	e9 1f fa ff ff       	jmpq   4714 <__sprintf_chk@plt+0x1fa4>

    4cf5:	44 8b 3d 60 47 00 00 	mov    0x4760(%rip),%r15d        # 945c <stderr@@GLIBC_2.2.5+0x3c>  // gvar_945c
    4cfc:	45 85 ff             	test   %r15d,%r15d              // r15d=info=gvar_945c
    4cff:	0f 84 ab f7 ff ff    	je     44b0 <__sprintf_chk@plt+0x1d40>
    if (gvar_945c == 0) {
        je 44b0
    }

    4d05:	41 bf 01 00 00 00    	mov    $0x1,%r15d               // r15d=info=0x1
    4d0b:	bf 28 00 00 00       	mov    $0x28,%edi               // edi=0x28='('

    4d10:	e8 7b f2 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)
    4d15:	41 8b 7d 58          	mov    0x58(%r13),%edi                  // edi=(rsp+0x58)=current->pgid
    4d19:	e8 42 f3 ff ff       	callq  4060 <__sprintf_chk@plt+0x18f0>  // fun_4060(current->pgid)
    4d1e:	e9 8d f7 ff ff       	jmpq   44b0 <__sprintf_chk@plt+0x1d40>
    fun_3f90(const char ch);
    fun_4060(current->pgid);

    4d23:	44 8b 25 9e 45 00 00 	mov    0x459e(%rip),%r12d        # 92c8 <_IO_stdin_used@@Base+0x32c8>   // gvar_92c8
    4d2a:	45 85 e4             	test   %r12d,%r12d              // gvar_92c8 ?= 0
    4d2d:	0f 84 69 fa ff ff    	je     479c <__sprintf_chk@plt+0x202c>  // gvar_92c8=0
    4d33:	48 8b 05 d6 45 00 00 	mov    0x45d6(%rip),%rax        # 9310 <age_to_color@@Base+0x30>        // 9310=shape_pointer
    4d3a:	48 8b 58 28          	mov    0x28(%rax),%rbx          // rbx=(rax+0x28)=shape_pointer->six
    4d3e:	0f b6 03             	movzbl (%rbx),%eax
    4d41:	84 c0                	test   %al,%al
    4d43:	74 16                	je     4d5b <__sprintf_chk@plt+0x25eb>
    4d45:	0f 1f 00             	nopl   (%rax)
    4d48:	0f be f8             	movsbl %al,%edi
    4d4b:	48 83 c3 01          	add    $0x1,%rbx
    4d4f:	e8 3c f2 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)    
    4d54:	0f b6 03             	movzbl (%rbx),%eax
    4d57:	84 c0                	test   %al,%al
    4d59:	75 ed                	jne    4d48 <__sprintf_chk@plt+0x25d8>
        out_string(shape_pointer->six);

    4d5b:	bf 2b 00 00 00       	mov    $0x2b,%edi
    4d60:	e8 2b f2 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)
        fun_3f90('+');

    4d65:	48 83 c4 28          	add    $0x28,%rsp
    4d69:	5b                   	pop    %rbx
    4d6a:	5d                   	pop    %rbp
    4d6b:	41 5c                	pop    %r12
    4d6d:	41 5d                	pop    %r13
    4d6f:	41 5e                	pop    %r14
    4d71:	41 5f                	pop    %r15
    4d73:	e9 98 f4 ff ff       	jmpq   4210 <__sprintf_chk@plt+0x1aa0>  // fun_4210()
        fun_4210();

    4d78:	8d 45 02             	lea    0x2(%rbp),%eax       // eax=info+0x2
    4d7b:	45 85 ff             	test   %r15d,%r15d          // 
    4d7e:	74 85                	je     4d05 <__sprintf_chk@plt+0x2595>
    if (info == 0) {
        // je 4d05
        fun_3f90('(');
        fun_4060(current->pgid);
        // jmpq  44b0
    }
    4d80:	41 89 c7             	mov    %eax,%r15d
    4d83:	bf 2c 00 00 00       	mov    $0x2c,%edi       // edi=0x2c=','
    4d88:	eb 86                	jmp    4d10 <__sprintf_chk@plt+0x25a0>
    fun_3f90(',');
    fun_4060(current->pgid);
    // jmpq  44b0

    4d8a:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
    4d90:	b8 2e 00 00 00       	mov    $0x2e,%eax               // eax=0x2e='.'
    4d95:	48 8d 1d 4d 13 00 00 	lea    0x134d(%rip),%rbx        # 60e9 <_IO_stdin_used@@Base+0xe9>
    4d9c:	0f 1f 40 00          	nopl   0x0(%rax)
    4da0:	0f be f8             	movsbl %al,%edi
    4da3:	48 83 c3 01          	add    $0x1,%rbx
    4da7:	e8 e4 f1 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)
    4dac:	0f b6 03             	movzbl (%rbx),%eax
    4daf:	84 c0                	test   %al,%al
    4db1:	75 ed                	jne    4da0 <__sprintf_chk@plt+0x2630>
    4db3:	e9 d8 f8 ff ff       	jmpq   4690 <__sprintf_chk@plt+0x1f20>
    
    4db8:	bf 28 00 00 00       	mov    $0x28,%edi   // edi=0x28='('
    4dbd:	e8 ce f1 ff ff       	callq  3f90 <__sprintf_chk@plt+0x1820>  // fun_3f90(const char ch)
    4dc2:	e9 9c f6 ff ff       	jmpq   4463 <__sprintf_chk@plt+0x1cf3>

    4dc7:	48 8b 05 42 45 00 00 	mov    0x4542(%rip),%rax        # 9310 <age_to_color@@Base+0x30>        // 9310=shape_pointer
    4dce:	44 8b 74 24 10       	mov    0x10(%rsp),%r14d
    4dd3:	44 8b 64 24 08       	mov    0x8(%rsp),%r12d

    4dd8:	48 8b 68 20          	mov    0x20(%rax),%rbp          // rbp=shape_pointer->five
    4ddc:	45 31 ff             	xor    %r15d,%r15d              // r15=0
    4ddf:	e9 a5 fe ff ff       	jmpq   4c89 <__sprintf_chk@plt+0x2519>

    4de4:	41 8b 7d 5c          	mov    0x5c(%r13),%edi      // edi=current->uid
    4de8:	41 89 df             	mov    %ebx,%r15d           // r15d=ebx=info
    4deb:	e8 70 f2 ff ff       	callq  4060 <__sprintf_chk@plt+0x18f0>  // fun_4060(current->uid)
    4df0:	e9 22 f7 ff ff       	jmpq   4517 <__sprintf_chk@plt+0x1da7>

    4df5:	31 ed                	xor    %ebp,%ebp            // ebp=0
    4df7:	ba 01 00 00 00       	mov    $0x1,%edx            // edx=1
    4dfc:	b8 01 00 00 00       	mov    $0x1,%eax            // eax=1
    4e01:	e9 c3 fd ff ff       	jmpq   4bc9 <__sprintf_chk@plt+0x2459>

    4e06:	8b 54 24 10          	mov    0x10(%rsp),%edx
    4e0a:	85 d2                	test   %edx,%edx
    4e0c:	75 b9                	jne    4dc7 <__sprintf_chk@plt+0x2657>

    4e0e:	41 8b 45 5c          	mov    0x5c(%r13),%eax      // eax=current->uid
    4e12:	31 c9                	xor    %ecx,%ecx            // ecx=0
    4e14:	49 39 9d b0 00 00 00 	cmp    %rbx,0xb0(%r13)      // (r13+0xb0)=current->children
    4e1b:	c7 44 24 10 01 00 00 	movl   $0x1,0x10(%rsp)
    4e22:	00 
    4e23:	c7 44 24 18 01 00 00 	movl   $0x1,0x18(%rsp)
    4e2a:	00 
    4e2b:	4c 8b 2b             	mov    (%rbx),%r13
    4e2e:	0f 94 c1             	sete   %cl
    4e31:	89 44 24 1c          	mov    %eax,0x1c(%rsp)
    4e35:	e9 31 f5 ff ff       	jmpq   436b <__sprintf_chk@plt+0x1bfb>

    4e3a:	48 8d 0d 0f 1e 00 00 	lea    0x1e0f(%rip),%rcx        # 6c50 <_IO_stdin_used@@Base+0xc50>
    4e41:	ba bd 02 00 00       	mov    $0x2bd,%edx
    4e46:	48 8d 35 a5 12 00 00 	lea    0x12a5(%rip),%rsi        # 60f2 <_IO_stdin_used@@Base+0xf2>      // "src/pstree.c"
    4e4d:	48 8d 3d ab 12 00 00 	lea    0x12ab(%rip),%rdi        # 60ff <_IO_stdin_used@@Base+0xff>      // "closing >= 0"
    4e54:	e8 07 d7 ff ff       	callq  2560 <__assert_fail@plt>

    4e59:	48 8d 3d af 12 00 00 	lea    0x12af(%rip),%rdi        # 610f <_IO_stdin_used@@Base+0x10f>     // "realloc"
    4e60:	e8 7b d8 ff ff       	callq  26e0 <perror@plt>
    4e65:	bf 01 00 00 00       	mov    $0x1,%edi
    4e6a:	e8 91 d8 ff ff       	callq  2700 <exit@plt>
    4e6f:	90                   	nop*/

void fun_4e70(PROC * current, uid_t uid)
{
    const CHILD *walk;

    /*4e70:	48 85 ff             	test   %rdi,%rdi    // rdi=current
    4e73:	74 3b                	je     4eb0 <__sprintf_chk@plt+0x2740>*/
    if (current == NULL) {
        return;
    }

    /*4e75:	41 54                	push   %r12
    4e77:	49 89 fc             	mov    %rdi,%r12    // r12=current
    4e7a:	55                   	push   %rbp
    4e7b:	89 f5                	mov    %esi,%ebp    // ebp=uid
    4e7d:	53                   	push   %rbx
    4e7e:	39 77 5c             	cmp    %esi,0x5c(%rdi)  // current->uid ?= uid
    4e81:	74 35                	je     4eb8 <__sprintf_chk@plt+0x2748>*/
    if (current->uid == uid) {
        // je 4eb8
        if (gvar_9438) {
            // jne 4f00 --> jmp 4ec2
            putchar(0xa);
        }

        fun_4340(current, 0, 1, 1, 1, uid, 0);
        gvar_9438 = 1;

        return;
    }

    /*4e83:	48 8b 9f b0 00 00 00 	mov    0xb0(%rdi),%rbx  // rbx=walk=current->children
    4e8a:	48 85 db             	test   %rbx,%rbx        // walk?=NULL
    4e8d:	74 13                	je     4ea2 <__sprintf_chk@plt+0x2732>*/
    for (walk = current->children; walk; walk = walk->next) {

    /*4e8f:	48 8b 3b             	mov    (%rbx),%rdi      // rdi=walk->child
    4e92:	89 ee                	mov    %ebp,%esi        // esi=uid
    4e94:	e8 d7 ff ff ff       	callq  4e70 <__sprintf_chk@plt+0x2700>*/
        fun_4e70(walk->child, uid);

    /*4e99:	48 8b 5b 08          	mov    0x8(%rbx),%rbx   // walk=walk->next
    4e9d:	48 85 db             	test   %rbx,%rbx        // walk?=NULL
    4ea0:	75 ed                	jne    4e8f <__sprintf_chk@plt+0x271f>*/
    }

    /*4ea2:	5b                   	pop    %rbx
    4ea3:	5d                   	pop    %rbp
    4ea4:	41 5c                	pop    %r12
    4ea6:	c3                   	retq   
    4ea7:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
    4eae:	00 00 
    4eb0:	c3                   	retq   */
}

    /*4eb1:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    4eb8:	8b 0d 7a 45 00 00    	mov    0x457a(%rip),%ecx        # 9438 <stderr@@GLIBC_2.2.5+0x18>   gvar_9438
    4ebe:	85 c9                	test   %ecx,%ecx
    4ec0:	75 3e                	jne    4f00 <__sprintf_chk@plt+0x2790>
        if (gvar_9438) {
            // jne 4f00 --> jmp 4ec2
            putchar(0xa);
        }

    4ec2:	48 83 ec 08          	sub    $0x8,%rsp
    4ec6:	41 89 e9             	mov    %ebp,%r9d    // r9d=uid
    4ec9:	ba 01 00 00 00       	mov    $0x1,%edx    // edx=1
    4ece:	4c 89 e7             	mov    %r12,%rdi    // rdi=current
    4ed1:	6a 00                	pushq  $0x0         // 0
    4ed3:	41 b8 01 00 00 00    	mov    $0x1,%r8d    // r8d=1
    4ed9:	b9 01 00 00 00       	mov    $0x1,%ecx    // ecx=1
    4ede:	31 f6                	xor    %esi,%esi    // esi=0
    4ee0:	e8 5b f4 ff ff       	callq  4340 <__sprintf_chk@plt+0x1bd0>  // fun_4340
        fun_4340(current, 0, 1, 1, 1, uid, 0);

    4ee5:	58                   	pop    %rax
    4ee6:	5a                   	pop    %rdx
    4ee7:	c7 05 47 45 00 00 01 	movl   $0x1,0x4547(%rip)        # 9438 <stderr@@GLIBC_2.2.5+0x18>   gvar_9438
        gvar_9438 = 1;

    4eee:	00 00 00 
    4ef1:	5b                   	pop    %rbx
    4ef2:	5d                   	pop    %rbp
    4ef3:	41 5c                	pop    %r12
    4ef5:	c3                   	retq   
        return;

    4ef6:	66 2e 0f 1f 84 00 00 	nopw   %cs:0x0(%rax,%rax,1)
    4efd:	00 00 00 

    4f00:	48 8b 35 e1 44 00 00 	mov    0x44e1(%rip),%rsi        # 93e8 <stdout@@GLIBC_2.2.5>        // rsi=gvar_93e8
    4f07:	bf 0a 00 00 00       	mov    $0xa,%edi
    4f0c:	e8 cf d6 ff ff       	callq  25e0 <putc@plt>  // putchar(0xa)
    4f11:	eb af                	jmp    4ec2 <__sprintf_chk@plt+0x2752>
    4f13:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    4f1a:	00 00 00 00 
    4f1e:	66 90                	xchg   %ax,%ax*/

int fun_4f20(PROC * parent, PROC * child)
{
    /*4f20:	41 57                	push   %r15             // r15=0, rsp=0x7fffffff9970
    4f22:	41 56                	push   %r14             // r14=0, rsp=0x7fffffff9968
    4f24:	41 55                	push   %r13             // r13=0, rsp=0x7fffffff9960
    4f26:	41 54                	push   %r12             // r12=0, rsp=0x7fffffff9958
    4f28:	49 89 f4             	mov    %rsi,%r12        // r12=rsi=child=temp, r12=rsi=0x555555569260:"systemd"
    4f2b:	55                   	push   %rbp             // rbp=temp_b=parent, rbp=0x555555569330:0x000000000000003f
    4f2c:	53                   	push   %rbx             // rbx=temp=child, rbx=0x555555569260:"systemd"
    4f2d:	48 89 fb             	mov    %rdi,%rbx        // rbx=rdi=temp_b=parent, rbx=rdi=0x555555569330:0x3f
    4f30:	bf 10 00 00 00       	mov    $0x10,%edi       // edi=0x10, rax=0x555555569330
    4f35:	48 83 ec 08          	sub    $0x8,%rsp        // rsp=rsp-0x8
    4f39:	e8 02 d7 ff ff       	callq  2640 <malloc@plt>    // rax=0x555555560940:0x0000000000000000
    4f3e:	48 85 c0             	test   %rax,%rax        
    4f41:	74 76                	je     4fb9 <__sprintf_chk@plt+0x2849>*/
        CHILD *ac = NULL, **walk = NULL;
        int cmp = 0;

        if (!(ac = (CHILD *)malloc(sizeof(CHILD)))) {
            // je 4fb9
            perror("fun_4f20 malloc");
            exit(1);
        }

    /*4f43:	4c 8d ab b0 00 00 00 	lea    0xb0(%rbx),%r13      // r13=walk=&parent->children, r13=rbx+0xb0=0x5555555693e0
    4f4a:	4c 89 20             	mov    %r12,(%rax)          // ac->child=child, rax=0x555555560940(自身地址):0x555555569260(指向地址)
    4f4d:	49 89 c7             	mov    %rax,%r15*/          // r15=ac， r15=0x555555560940
        ac->child = child;

    /*4f50:	48 8b 9b b0 00 00 00 	mov    0xb0(%rbx),%rbx      // rbx+0xb0=0x5555555693e0:0x00, rbx=*walk=parent->children=0x00(指向地址为空)
    4f57:	48 85 db             	test   %rbx,%rbx            // *walk=parent->children ?= NULL
    4f5a:	74 46                	je     4fa2 <__sprintf_chk@plt+0x2832>*/    // break
        for (walk = &parent->children; *walk; *walk = parent->children->next) {

    /*4f5c:	44 8b 35 f1 44 00 00 	mov    0x44f1(%rip),%r14d        # 9454 <stderr@@GLIBC_2.2.5+0x34>  // gvar_9454
    4f63:	eb 1a                	jmp    4f7f <__sprintf_chk@plt+0x280f>
    4f65:	0f 1f 00             	nopl   (%rax)

    4f68:	41 8b 44 24 54       	mov    0x54(%r12),%eax      // eax=child->pid
    4f6d:	39 45 54             	cmp    %eax,0x54(%rbp)      // (rbp+0x54)=parent->children->child->pid
    4f70:	7f 30                	jg     4fa2 <__sprintf_chk@plt+0x2832>  // break

    4f72:	4c 8d 6b 08          	lea    0x8(%rbx),%r13       // r13=walk=&(*walk)->next=&parent->children->next, 指针自身地址
    4f76:	48 8b 5b 08          	mov    0x8(%rbx),%rbx       // rbx=parent->children->next， 指针指向地址
    4f7a:	48 85 db             	test   %rbx,%rbx            // parent->children->next ?= NULL
    4f7d:	74 23                	je     4fa2 <__sprintf_chk@plt+0x2832>  // break

    4f7f:	48 8b 2b             	mov    (%rbx),%rbp      // rbp=parent->children->child
    4f82:	45 85 f6             	test   %r14d,%r14d      // gvar_9454 ?= 0
    4f85:	75 e1                	jne    4f68 <__sprintf_chk@plt+0x27f8>*/
            if (gvar_9454 != 0) {
                // jne 4f68
                if ((*walk)->child->pid > child->pid) {
                    // jg 4fa2
                    break;
                }
            }

    /*4f87:	4c 89 e6             	mov    %r12,%rsi        // rsi=r12=child
    4f8a:	48 89 ef             	mov    %rbp,%rdi        // rdi=rbp=parent->children->child
    4f8d:	e8 3e d6 ff ff       	callq  25d0 <strcmp@plt>    // strcmp(parent->children->child->comm, child->comm)
    4f92:	85 c0                	test   %eax,%eax            // eax=strcmp return value
    4f94:	7f 0c                	jg     4fa2 <__sprintf_chk@plt+0x2832>      // break
    4f96:	75 da                	jne    4f72 <__sprintf_chk@plt+0x2802>*/
            else if ((cmp = strcmp((*walk)->child->comm, child->comm)) > 0) {
                break; 
            }
    /*4f98:	41 8b 44 24 5c       	mov    0x5c(%r12),%eax  // eax=(r12+0x5c)=child->uid
    4f9d:	39 45 5c             	cmp    %eax,0x5c(%rbp)  // (rbp+0x5c)=parent->children->child->uid
    4fa0:	76 d0                	jbe    4f72 <__sprintf_chk@plt+0x2802>*/
            else if (!cmp && (*walk)->child->uid > child->uid) {
                break;
            }
        }   /* for */

    /*4fa2:	49 89 5f 08          	mov    %rbx,0x8(%r15)       // r15=ac->next, rbx=*walk
    4fa6:	4d 89 7d 00          	mov    %r15,0x0(%r13)*/     // r15=ac, (r13+0x0)=*walk， r13+0x0=walk
        ac->next = *walk;
        *walk = ac;

    /*4faa:	48 83 c4 08          	add    $0x8,%rsp
    4fae:	5b                   	pop    %rbx
    4faf:	5d                   	pop    %rbp
    4fb0:	41 5c                	pop    %r12
    4fb2:	41 5d                	pop    %r13
    4fb4:	41 5e                	pop    %r14
    4fb6:	41 5f                	pop    %r15
    4fb8:	c3                   	retq  */
    return 0;
}

    /* reversed */
    /*4fb9:	48 8d 3d 16 11 00 00 	lea    0x1116(%rip),%rdi        # 60d6 <_IO_stdin_used@@Base+0xd6>
    4fc0:	e8 1b d7 ff ff       	callq  26e0 <perror@plt>    // perror("")
    4fc5:	bf 01 00 00 00       	mov    $0x1,%edi
    4fca:	e8 31 d7 ff ff       	callq  2700 <exit@plt>      // exit(1)
    4fcf:	90                   	nop*/

static PROC *fun_4fd0(const char *comm, pid_t pid, uid_t uid)
{
    /*4fd0:	41 57                	push   %r15
    4fd2:	41 56                	push   %r14
    4fd4:	49 89 fe             	mov    %rdi,%r14    // r14=rdi=comm
    4fd7:	bf c8 00 00 00       	mov    $0xc8,%edi   // edi=0xc8
    4fdc:	41 55                	push   %r13
    4fde:	41 89 d5             	mov    %edx,%r13d   // r13d=uid
    4fe1:	41 54                	push   %r12
    4fe3:	55                   	push   %rbp
    4fe4:	89 f5                	mov    %esi,%ebp    // ebp=pid
    4fe6:	53                   	push   %rbx
    4fe7:	48 89 cb             	mov    %rcx,%rbx    // rbx=rcx=0
    4fea:	48 81 ec d8 00 00 00 	sub    $0xd8,%rsp   // rsp=rsp-0xd8  (d8/8=27)
    4ff1:	64 48 8b 04 25 28 00 	mov    %fs:0x28,%rax
    4ff8:	00 00 
    4ffa:	48 89 84 24 c8 00 00 	mov    %rax,0xc8(%rsp)  // overflow check
    5001:	00 
    5002:	31 c0                	xor    %eax,%eax
    5004:	e8 37 d6 ff ff       	callq  2640 <malloc@plt>
    5009:	48 85 c0             	test   %rax,%rax
    500c:	0f 84 1f 01 00 00    	je     5131 <__sprintf_chk@plt+0x29c1>*/
    PROC * temp = NULL;
    struct stat st;
    char buff[64] = {0};
    int i = 0;

    temp = (PROC*)malloc(sizeof(PROC));
    if (temp == NULL) {
        // je 5131
        perror("malloc");
        exit(1);
    }

    /*5012:	4c 89 f6             	mov    %r14,%rsi    // rsi=comm
    5015:	ba 42 00 00 00       	mov    $0x42,%edx   // edx=0x42=66
    501a:	48 89 c7             	mov    %rax,%rdi    // rdi=rax=temp
    501d:	49 89 c4             	mov    %rax,%r12    // r12=rax=temp
    5020:	e8 1b d4 ff ff       	callq  2440 <strncpy@plt>*/
    strncpy(temp->comm, comm, 0x42);

    /*5025:	48 8b 05 5c 44 00 00 	mov    0x445c(%rip),%rax        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // gvar_9488
    502c:	45 89 6c 24 5c       	mov    %r13d,0x5c(%r12)     // temp->uid = uid
    5031:	4c 8d bc 24 90 00 00 	lea    0x90(%rsp),%r15      // r15=rsp+0x90=buff     (0x90/8=18)
    5038:	00 
    5039:	49 89 5c 24 60       	mov    %rbx,0x60(%r12)      // temp->ns[0] = 0
    503e:	4d 8d 6c 24 68       	lea    0x68(%r12),%r13      // r13=temp->ns[1]
    #if 0
    0x55555555cba0:	0x000055555555a117	0x000055555555a321
    0x55555555cbb0:	0x000055555555a325	0x000055555555a329
    0x55555555cbc0:	0x000055555555a044	0x000055555555a32d
    0x55555555cbd0:	0x000055555555a332	0x0000000000000001
    #endif
    5043:	48 8d 1d 5e 3b 00 00 	lea    0x3b5e(%rip),%rbx        # 8ba8 <_IO_stdin_used@@Base+0x2ba8>    // rbx=gvar_8ba0[1]
    504a:	49 89 e6             	mov    %rsp,%r14            // r14=rsp=st,  rsp=0x7fffffff9550
    504d:	49 89 84 24 c0 00 00 	mov    %rax,0xc0(%r12)      // temp->next = gvar_9488
    5054:	00 
    5055:	48 8d 05 bb 10 00 00 	lea    0x10bb(%rip),%rax        # 6117 <_IO_stdin_used@@Base+0x117>     // rax="cgroup"
    505c:	41 c6 44 24 41 00    	movb   $0x0,0x41(%r12)      // comm[0x41] = 0
    5062:	41 89 6c 24 54       	mov    %ebp,0x54(%r12)      // temp->pid = pid
    5067:	41 c6 84 24 a0 00 00 	movb   $0x0,0xa0(%r12)      // flags
    506e:	00 00   
    5070:	41 c7 44 24 50 00 00 	movl   $0x0,0x50(%r12)      // argc
    5077:	00 00 
    5079:	49 c7 44 24 48 00 00 	movq   $0x0,0x48(%r12)      // **argv
    5080:	00 00 
    5082:	49 c7 84 24 b0 00 00 	movq   $0x0,0xb0(%r12)      // *children
    5089:	00 00 00 00 00 
    508e:	49 c7 84 24 b8 00 00 	movq   $0x0,0xb8(%r12)      // *parent
    5095:	00 00 00 00 00 */
    temp->comm[0x41] = '\0';
    temp->pid = pid;
    temp->uid = uid;
    temp->flags = 0;
    temp->argc = 0;
    temp->argv = NULL;
    temp->children = NULL;
    temp->parent = NULL;
    temp->next = gvar_9488;

    /*509a:	eb 0b                	jmp    50a7 <__sprintf_chk@plt+0x2937>
    509c:	0f 1f 40 00          	nopl   0x0(%rax)*/
    for (i = 0; i < 8; i++) {

    /*50a0:	48 8b 03             	mov    (%rbx),%rax      // rax=gvar_8ba0[1]="ipc"
    50a3:	48 83 c3 08          	add    $0x8,%rbx        // rbx=gvar_8ba0[2]

    50a7:	48 83 ec 08          	sub    $0x8,%rsp        // 0x7fffffff9548
    50ab:	b9 32 00 00 00       	mov    $0x32,%ecx       // ecx=0x32
    50b0:	41 89 e9             	mov    %ebp,%r9d        // r9d=ebp=pid
    50b3:	4c 89 ff             	mov    %r15,%rdi        // rdi=buff
    50b6:	50                   	push   %rax             // 0x7fffffff9540:0x000055555555a117, 此为传参
    50b7:	4c 8d 05 60 10 00 00 	lea    0x1060(%rip),%r8        # 611e <_IO_stdin_used@@Base+0x11e>  // "/proc/%i/ns/%s"
    50be:	ba 01 00 00 00       	mov    $0x1,%edx        // edx=1
    50c3:	31 c0                	xor    %eax,%eax        // eax=0
    50c5:	be 32 00 00 00       	mov    $0x32,%esi       // esi=32
    50ca:	e8 21 d3 ff ff       	callq  23f0 <__snprintf_chk@plt>*/
        sprintf(buff, "/proc/%i/ns/%s", pid, gvar_8ba0[i]);

    /*50cf:	4c 89 f2             	mov    %r14,%rdx        // rdx=r14=st
    50d2:	4c 89 fe             	mov    %r15,%rsi        // buff="/proc/1/ns/cgroup"
    50d5:	bf 01 00 00 00       	mov    $0x1,%edi        // edi
    50da:	e8 41 d5 ff ff       	callq  2620 <__xstat@plt>*/
        if (__xstat(1, buff, &st)) {
            temp->ns[i] = 0;
            continue;
        }

    /*50df:	5a                   	pop    %rdx             // rdx=0x000055555555a117, rsp=0x7fffffff9548
    50e0:	59                   	pop    %rcx             // rcx=0x555555559025, rsp=0x7fffffff9550
    50e1:	85 c0                	test   %eax,%eax
    50e3:	b8 00 00 00 00       	mov    $0x0,%eax
    50e8:	48 0f 44 44 24 08    	cmove  0x8(%rsp),%rax   // rsp+0x8=0x7fffffff9558, cmove:Move if equal (ZF=1)
    50ee:	49 83 c5 08          	add    $0x8,%r13        // r13=temp->ns[1], temp->ns[2], ...
    50f2:	49 89 45 f8          	mov    %rax,-0x8(%r13)*/// temp->ns[1] = rax
        temp->ns[i] = st.st_ino;    // __xstat返回值eax为零时才执行，不为零时继续for循环，此处隐含了上面的 continue 语句。

    /*50f6:	48 8d 05 db 3a 00 00 	lea    0x3adb(%rip),%rax        # 8bd8 <_IO_stdin_used@@Base+0x2bd8>    rax=gvar_8ba0[1]
    50fd:	48 39 c3             	cmp    %rax,%rbx        // 8bd8-8ba0=0x38, 0x38/8=7
    5100:	75 9e                	jne    50a0 <__sprintf_chk@plt+0x2930>*/
    }   /* for (i = 0; i < 8; i++) end */

    /*5102:	4c 89 25 7f 43 00 00 	mov    %r12,0x437f(%rip)        # 9488 <stderr@@GLIBC_2.2.5+0x68> */    // gvar_9488
    gvar_9488 = temp;

    /*5109:	48 8b 84 24 c8 00 00 	mov    0xc8(%rsp),%rax
    5110:	00 
    5111:	64 48 33 04 25 28 00 	xor    %fs:0x28,%rax
    5118:	00 00 
    511a:	75 2b                	jne    5147 <__sprintf_chk@plt+0x29d7>
    511c:	48 81 c4 d8 00 00 00 	add    $0xd8,%rsp
    5123:	4c 89 e0             	mov    %r12,%rax
    5126:	5b                   	pop    %rbx
    5127:	5d                   	pop    %rbp
    5128:	41 5c                	pop    %r12
    512a:	41 5d                	pop    %r13
    512c:	41 5e                	pop    %r14
    512e:	41 5f                	pop    %r15
    5130:	c3                   	retq */
    return gvar_9488;
}

    #if 0
    /*5131:	48 8d 3d 9e 0f 00 00 	lea    0xf9e(%rip),%rdi        # 60d6 <_IO_stdin_used@@Base+0xd6>
    5138:	e8 a3 d5 ff ff       	callq  26e0 <perror@plt>
        perror("");

    513d:	bf 01 00 00 00       	mov    $0x1,%edi
    5142:	e8 b9 d5 ff ff       	callq  2700 <exit@plt>
        exit(1);

    5147:	e8 d4 d3 ff ff       	callq  2520 <__stack_chk_fail@plt>
    514c:	0f 1f 40 00          	nopl   0x0(%rax)*/
    #endif

int fun_5150(const char *comm, pid_t pid, pid_t ppid, pid_t pgid, uid_t uid,
         const char *args, int size, char isthread, double process_age_sec)  ////
{
    /*5150:	41 57                	push   %r15
    5152:	41 56                	push   %r14
    5154:	45 89 c6             	mov    %r8d,%r14d           // r14d=uid=st.st_uid
    5157:	41 55                	push   %r13
    5159:	41 89 d5             	mov    %edx,%r13d           // r13d=ppid
    515c:	41 54                	push   %r12
    515e:	41 89 f4             	mov    %esi,%r12d           // r12d=pid
    5161:	55                   	push   %rbp
    5162:	4c 89 cd             	mov    %r9,%rbp             // rbp=args=buffer
    5165:	53                   	push   %rbx
    5166:	48 83 ec 28          	sub    $0x28,%rsp           // rsp=rsp-0x28(40)
    516a:	48 8b 1d 17 43 00 00 	mov    0x4317(%rip),%rbx        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // rbx=temp=gvar_9488
    5171:	8b 44 24 68          	mov    0x68(%rsp),%eax      // isthread 经以上栈变化共发生16次，0x68换算为13次，16-13=3 --> 399a:	6a 01  pushq  $0x1
    5175:	89 4c 24 10          	mov    %ecx,0x10(%rsp)      // (rsp+0x10)=ecx=pgid
    5179:	f2 0f 11 44 24 18    	movsd  %xmm0,0x18(%rsp)     // xmm0=process_age_sec=sc_clk_tck
    517f:	89 44 24 14          	mov    %eax,0x14(%rsp)      // (rsp+0x14)=eax=isthread=1*/
        PROC *temp = NULL, *temp_b = NULL;

    /*5183:	48 85 db             	test   %rbx,%rbx            // rbx=temp
    5186:	75 18                	jne    51a0 <__sprintf_chk@plt+0x2a30>
    5188:	e9 3b 02 00 00       	jmpq   53c8 <__sprintf_chk@plt+0x2c58>
    518d:	0f 1f 00             	nopl   (%rax)*/
        /* if (temp == NULL) {
            jump 53c8
        } */

    /*5190:	48 8b 9b c0 00 00 00 	mov    0xc0(%rbx),%rbx      // temp=temp->next
    5197:	48 85 db             	test   %rbx,%rbx            // temp->next & temp->next
    519a:	0f 84 28 02 00 00    	je     53c8 <__sprintf_chk@plt+0x2c58>*/        
        /* 把上面的 if (temp == NULL) 下移 */
    
    /*51a0:	44 3b 63 54          	cmp    0x54(%rbx),%r12d     // 0x54=temp->pid
    51a4:	75 ea                	jne    5190 <__sprintf_chk@plt+0x2a20>*/
        for (temp = gvar_9488; temp; temp = temp->next) {
            if (temp->pid == pid) {
                break;
            }
        }

        if (temp == NULL) {
            // jump 53c8
            temp=fun_4fd0(comm, pid, uid);
            // jump 5219
        }   /* if (temp == NULL) */
        else {  /* if (temp != NULL) */

    /*51a6:	48 89 fe             	mov    %rdi,%rsi            // rsi=rdi=comm=strchr_ret
    51a9:	ba 42 00 00 00       	mov    $0x42,%edx           // edx=0x42
    51ae:	48 89 df             	mov    %rbx,%rdi            // rdi=rbx=temp
    51b1:	e8 8a d2 ff ff       	callq  2440 <strncpy@plt>*/
            strncpy(temp->comm, comm, 0x42);

    /*51b6:	8b 05 98 42 00 00    	mov    0x4298(%rip),%eax        # 9454 <stderr@@GLIBC_2.2.5+0x34>   // eax=gvar_9454
    51bc:	c6 43 41 00          	movb   $0x0,0x41(%rbx)*/
            temp->comm[0x41] = '\0';

    /*51c0:	44 89 73 5c          	mov    %r14d,0x5c(%rbx) */  // r14d=uid=st.st_uid
            temp->uid = uid;

    /*51c4:	85 c0                	test   %eax,%eax            // eax=gvar_9454
    51c6:	75 51                	jne    5219 <__sprintf_chk@plt+0x2aa9>      // if (gvar_9454 == 0)
    51c8:	48 8b 83 b8 00 00 00 	mov    0xb8(%rbx),%rax      // rax=temp->parent
    51cf:	48 85 c0             	test   %rax,%rax            // if (temp->parent != NULL)
    51d2:	74 45                	je     5219 <__sprintf_chk@plt+0x2aa9>*/
            if ((gvar_9454 == 0) && (temp->parent != NULL)) {

    /*51d4:	4c 8b b0 b0 00 00 00 	mov    0xb0(%rax),%r14      // r14=walk=&temp->parent->children
    51db:	4d 85 f6             	test   %r14,%r14            // *walk
    51de:	74 39                	je     5219 <__sprintf_chk@plt+0x2aa9>*/
                PROC *tmp_child = NULL;
                CHILD **walk = NULL;
                for (walk = &temp->parent->children; *walk; walk = &temp->parent->children->next) {

    /*51e0:	4d 8b 7e 08          	mov    0x8(%r14),%r15       // r15=walk=temp->parent->children->next
    51e4:	4d 85 ff             	test   %r15,%r15            // r15=*walk
    51e7:	74 27                	je     5210 <__sprintf_chk@plt+0x2aa0>*/
                    if ((temp->parent->children->next != NULL) &&
                        (strcmp(temp->parent->children->child->comm, 
                                temp->parent->children->next->child->comm) > 0)) {

    /*51e9:	49 8b 37             	mov    (%r15),%rsi          // rsi=temp->parent->children->next->child->comm
    51ec:	49 8b 3e             	mov    (%r14),%rdi          // rdi=temp->parent->children->child->comm
    51ef:	48 89 74 24 08       	mov    %rsi,0x8(%rsp)       // temp->parent->children->next->child->comm
    51f4:	48 89 3c 24          	mov    %rdi,(%rsp)          // temp->parent->children->child->comm
    51f8:	e8 d3 d3 ff ff       	callq  25d0 <strcmp@plt>
    51fd:	85 c0                	test   %eax,%eax
    51ff:	7e 0f                	jle    5210 <__sprintf_chk@plt+0x2aa0>

    5201:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi   // rsi=temp->parent->children->next->child
    5206:	48 8b 3c 24          	mov    (%rsp),%rdi      // rdi=temp->parent->children->child
    520a:	49 89 36             	mov    %rsi,(%r14)      // r14=temp->parent->children->next->child
    520d:	49 89 3f             	mov    %rdi,(%r15)*/    // r15=temp->parent->children->child
                        tmp_child = temp->parent->children->child;
                        temp->parent->children->child = temp->parent->children->next->child;
                        temp->parent->children->next->child = tmp_child;
                    }   /* if (temp->parent->children->next != NULL)  */

    /*5210:	4d 8b 76 08          	mov    0x8(%r14),%r14
    5214:	4d 85 f6             	test   %r14,%r14
    5217:	75 c7                	jne    51e0 <__sprintf_chk@plt+0x2a70>*/
                }   /* for (; temp->parent->children; temp->parent->children->next) */
            }   /* if ((gvar_9454 == 0) && (temp->parent != NULL)) */
        }   /* if (temp != NULL) */

    /*5219:	48 85 ed             	test   %rbp,%rbp */            // rbp=args
        if (args != NULL) {
    
    /*521c:	0f 84 fe 00 00 00    	je     5320 <__sprintf_chk@plt+0x2bb0>
    5222:	8b 54 24 60          	mov    0x60(%rsp),%edx          // size
    5226:	85 d2                	test   %edx,%edx
    5228:	0f 84 b2 01 00 00    	je     53e0 <__sprintf_chk@plt+0x2c70>*/

            if (size == 0) {
                // je 53e0
                temp->argc = -1;
                goto goto_5320;
            }

    /*522e:	83 7c 24 60 01       	cmpl   $0x1,0x60(%rsp)          // size
    5233:	c7 43 50 00 00 00 00 	movl   $0x0,0x50(%rbx)          // temp->argc=0
    523a:	0f 8e e0 00 00 00    	jle    5320 <__sprintf_chk@plt+0x2bb0>
    5240:	8b 4c 24 60          	mov    0x60(%rsp),%ecx          // ecx=rcx=size
    5244:	48 89 e8             	mov    %rbp,%rax                // rax=rbp=args
    5247:	8d 51 fe             	lea    -0x2(%rcx),%edx          // edx=rdx=size-2
    524a:	31 c9                	xor    %ecx,%ecx                // ecx=0, int i = 0;
    524c:	48 8d 54 15 01       	lea    0x1(%rbp,%rdx,1),%rdx    // rdx=args[size-2]+0x1=args[size-1]
    5251:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/
            temp->argc = 0;

            if (size <= 1) 
                goto goto_5320;
            
            int i;
            for (i = 0; i < size - 1; i++) {        // ????? ac

    /*5258:	80 38 00             	cmpb   $0x0,(%rax)              // (rax)=*args
    525b:	75 06                	jne    5263 <__sprintf_chk@plt+0x2af3>
    525d:	83 c1 01             	add    $0x1,%ecx                // ecx+1
    5260:	89 4b 50             	mov    %ecx,0x50(%rbx)*/        // temp->argc=ecx++
                if (!args[i]) {
                    temp->argc++;

    /*5263:	48 83 c0 01          	add    $0x1,%rax            // rax+1=args[i]
    5267:	48 39 d0             	cmp    %rdx,%rax            // rdx=args[size-1], rax=args[i]
    526a:	75 ec                	jne    5258 <__sprintf_chk@plt+0x2ae8>*/
                    while (!args[i] && (i < size -1 ))
                        i++;
                }   /* if (!args[i]) */
            }   /* for (i = 0; i < size - 1; i++) */

    /*526c:	85 c9                	test   %ecx,%ecx
    526e:	0f 84 ac 00 00 00    	je     5320 <__sprintf_chk@plt+0x2bb0>*/

    /*5274:	48 63 f9             	movslq %ecx,%rdi            // rdi=ecx=argc, 符号扩展双字传送四字
    5277:	89 0c 24             	mov    %ecx,(%rsp)          // (rsp)=temp->argc
    527a:	48 c1 e7 03          	shl    $0x3,%rdi
    527e:	e8 bd d3 ff ff       	callq  2640 <malloc@plt>
    5283:	8b 0c 24             	mov    (%rsp),%ecx          // ecx=temp->argc
    5286:	48 85 c0             	test   %rax,%rax
    5289:	48 89 43 48          	mov    %rax,0x48(%rbx)      // **argv
    528d:	0f 84 7b 01 00 00    	je     540e <__sprintf_chk@plt+0x2c9e>*/
            temp->argv = (char **)malloc(temp->argc << 3);
            if (temp->argv == NULL) {
                perror("argv malloc fail.");
                exit(1);
            }

    /*5293:	48 89 ef             	mov    %rbp,%rdi            // rdi=rbp=temp->argv
    5296:	89 0c 24             	mov    %ecx,(%rsp)          // (rsp)=ecx=temp->argc
    5299:	48 89 44 24 08       	mov    %rax,0x8(%rsp)       // (rsp+0x8)=temp->argv
    529e:	e8 6d d2 ff ff       	callq  2510 <strlen@plt>*/  // rax=strlen(temp->argv[0]) 
            int len = strlen(temp->argv[0]);

    /*52a3:	44 8b 74 24 60       	mov    0x60(%rsp),%r14d     // r14d=(rsp+0x60)=size
    52a8:	48 83 c0 01          	add    $0x1,%rax            // rax=len+1
    52ac:	41 29 c6             	sub    %eax,%r14d           // r14d=size-(len+1)
    52af:	48 01 c5             	add    %rax,%rbp            // rbp=temp->argv+len
    52b2:	4d 63 f6             	movslq %r14d,%r14           // r14=size-(len+1)
    52b5:	4c 89 f7             	mov    %r14,%rdi            // rdi=size-(len+1)
    52b8:	e8 83 d3 ff ff       	callq  2640 <malloc@plt>         
    52bd:	4c 8b 44 24 08       	mov    0x8(%rsp),%r8        // r8=temp->argv
    52c2:	48 89 c7             	mov    %rax,%rdi            // rax=malloc
    52c5:	49 89 00             	mov    %rax,(%r8)           // temp->argv[0]=malloc
    52c8:	48 85 c0             	test   %rax,%rax
    52cb:	0f 84 3d 01 00 00    	je     540e <__sprintf_chk@plt+0x2c9e>*/
            temp->argv[0] = malloc(size-(len+1));
            if (temp->argv[0] == NULL ) {
                perror("malloc fail.");
                exit(1);
            }

    /*52d1:	4c 89 f2             	mov    %r14,%rdx            // rdx=size
    52d4:	48 89 ee             	mov    %rbp,%rsi            // rsi=temp->argv, rdi=temp->argv[0]
    52d7:	e8 34 d3 ff ff       	callq  2610 <memcpy@plt>*/
            char *str_memcpy = NULL;
            str_memcpy = memcpy(temp->argv[0], temp->argv, size);

    /*52dc:	8b 0c 24             	mov    (%rsp),%ecx          // ecx=temp->argc
    52df:	49 89 c6             	mov    %rax,%r14            // r14=str_memcpy
    52e2:	83 f9 01             	cmp    $0x1,%ecx            // temp->argc ?= 1
    52e5:	74 39                	je     5320 <__sprintf_chk@plt+0x2bb0>*/
            for (i = 1; i < temp->argc; i++) {

    /*52e7:	4c 8b 44 24 08       	mov    0x8(%rsp),%r8        // r8=temp->argv
    52ec:	8d 41 fe             	lea    -0x2(%rcx),%eax      // eax=temp->argc-2
    52ef:	49 8d 68 08          	lea    0x8(%r8),%rbp        // rbp=&temp->argv=temp->argv[0]
    52f3:	4d 8d 7c c0 10       	lea    0x10(%r8,%rax,8),%r15    // r15=temp->argv+(temp->argc-2)*8+0x10
    52f8:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
    52ff:	00 

    5300:	4c 89 f7             	mov    %r14,%rdi            // rdi=str_memcpy
    5303:	48 83 c5 08          	add    $0x8,%rbp            // rbp=&temp->argv+8=temp->argv[1]
    5307:	e8 04 d2 ff ff       	callq  2510 <strlen@plt>*/
                len = strlen(str_memcpy);

    /*530c:	4d 8d 74 06 01       	lea    0x1(%r14,%rax,1),%r14    // r14=str_memcpy+len*1+0x1
    5311:	4c 89 75 f8          	mov    %r14,-0x8(%rbp)      // temp->argv[i-1]=str_memcpy+len*1+0x1
    5315:	49 39 ef             	cmp    %rbp,%r15            // temp->argv[i] ?= temp->argv+(temp->argc-2)*8+0x10
    5318:	75 e6                	jne    5300 <__sprintf_chk@plt+0x2b90>
    531a:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)*/
                // temp->argv[i] = str_memcpy = strchr(str_memcpy, 0) + 1;
                temp->argv[i] = str_memcpy + len + 0x1;
            }   /* for (i = 1; i < temp->argv; i++) */
        }   /* if (args != NULL) */

    goto_5320:
    /*5320:	45 39 ec             	cmp    %r13d,%r12d          // r13d=ppid r12d=pid
    5323:	b8 00 00 00 00       	mov    $0x0,%eax            // eax=0
    5328:	f2 0f 10 4c 24 18    	movsd  0x18(%rsp),%xmm1     // xmm1=process_age_sec=sc_clk_tck
    532e:	44 0f 44 e8          	cmove  %eax,%r13d           // ppid=0
    5332:	8b 44 24 10          	mov    0x10(%rsp),%eax      // eax=(rsp+0x10)=pgid
    5336:	80 7c 24 14 00       	cmpb   $0x0,0x14(%rsp)      // (rsp+0x14)=isthread
    533b:	f2 0f 11 8b a8 00 00 	movsd  %xmm1,0xa8(%rbx)     // temp->age=process_age_sec
    5342:	00 
    5343:	89 43 58             	mov    %eax,0x58(%rbx)      // temp->pgid=pgid
    5346:	75 48                	jne    5390 <__sprintf_chk@plt+0x2c20>*/
        if (ppid == pid) {
            ppid = 0;
        }
        
        temp->age = process_age_sec;
        temp->pgid = pgid;

        if (isthread) {
            // jne 5390
            temp->flags |= 0x2;
            // jmp 5348
        }

    /*5348:	48 8b 2d 39 41 00 00 	mov    0x4139(%rip),%rbp        # 9488 <stderr@@GLIBC_2.2.5+0x68>   // gvar_9488
    534f:	48 85 ed             	test   %rbp,%rbp
    5352:	75 1c                	jne    5370 <__sprintf_chk@plt+0x2c00>
    5354:	e9 97 00 00 00       	jmpq   53f0 <__sprintf_chk@plt+0x2c80>
    5359:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/
        for (temp_b = gvar_9488; temp_b; temp_b = temp_b->next) {
            if (temp_b->pid == ppid) {
                break;
            }
        }

    /*5360:	48 8b ad c0 00 00 00 	mov    0xc0(%rbp),%rbp          // gvar_9488 = temp->next;
    5367:	48 85 ed             	test   %rbp,%rbp                // temp_b ?= NULL
    536a:	0f 84 80 00 00 00    	je     53f0 <__sprintf_chk@plt+0x2c80>  // == NULL, jump

    5370:	44 3b 6d 54          	cmp    0x54(%rbp),%r13d     // 0x54=temp_b->pid, r13d=ppid
    5374:	75 ea                	jne    5360 <__sprintf_chk@plt+0x2bf0>*/    // != , jump       
        if (temp_b == NULL) {
            // je 53f0
            temp_b = fun_4fd0("?", pid, 0);
        }

    /*5376:	45 85 e4             	test   %r12d,%r12d
    5379:	75 25                	jne    53a0 <__sprintf_chk@plt+0x2c30>*/
        if (pid == 0) {

    /*537b:	48 83 c4 28          	add    $0x28,%rsp
    537f:	5b                   	pop    %rbx
    5380:	5d                   	pop    %rbp
    5381:	41 5c                	pop    %r12
    5383:	41 5d                	pop    %r13
    5385:	41 5e                	pop    %r14
    5387:	41 5f                	pop    %r15
    5389:	c3                   	retq   
    538a:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)*/
        }

    /* reversed */
    /*5390:	80 8b a0 00 00 00 02 	orb    $0x2,0xa0(%rbx)  // (rbx+0xa0)=flags
    5397:	eb af                	jmp    5348 <__sprintf_chk@plt+0x2bd8>
    5399:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/

        if (pid != 0) {
    /*53a0:	48 89 de             	mov    %rbx,%rsi        // rsi=rbx=temp
    53a3:	48 89 ef             	mov    %rbp,%rdi        // rdi=rbp=temp_b
    53a6:	e8 75 fb ff ff       	callq  4f20 <__sprintf_chk@plt+0x27b0>  // fun_4f20
    53ab:	48 89 ab b8 00 00 00 	mov    %rbp,0xb8(%rbx)*/    // rpb=temp_b
            fun_4f20(temp_b, temp);
            temp->parent = temp_b;

    /*53b2:	48 83 c4 28          	add    $0x28,%rsp
    53b6:	5b                   	pop    %rbx
    53b7:	5d                   	pop    %rbp
    53b8:	41 5c                	pop    %r12
    53ba:	41 5d                	pop    %r13
    53bc:	41 5e                	pop    %r14
    53be:	41 5f                	pop    %r15
    53c0:	c3                   	retq   
    53c1:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)*/
        }

    return 0;
}
    /* reversed */
    /*53c8:	48 8b 4c 24 70       	mov    0x70(%rsp),%rcx      // comm // 0x7fffffff96d0 -> 3999:	52	push   %rdx
    53cd:	44 89 f2             	mov    %r14d,%edx           // edx=r14d=uid=st.st_uid
    53d0:	44 89 e6             	mov    %r12d,%esi           // r12d=pid, note:此处有隐性参数rdi=comm
    53d3:	e8 f8 fb ff ff       	callq  4fd0 <__sprintf_chk@plt+0x2860>  // fun_4fd0(comm, pid, uid)
    53d8:	48 89 c3             	mov    %rax,%rbx                        // rbx=rax=temp=fun_4fd0(comm, pid, uid)
    53db:	e9 39 fe ff ff       	jmpq   5219 <__sprintf_chk@plt+0x2aa9>*/

    /*53e0:	c7 43 50 ff ff ff ff 	movl   $0xffffffff,0x50(%rbx)   // temp->argc = -1
    53e7:	e9 34 ff ff ff       	jmpq   5320 <__sprintf_chk@plt+0x2bb0>
    53ec:	0f 1f 40 00          	nopl   0x0(%rax)*/

    /* reversed */
    /*53f0:	48 8b 4c 24 70       	mov    0x70(%rsp),%rcx      // (rsp+0x70)= ->ns[3] ?
    53f5:	31 d2                	xor    %edx,%edx            // edx=0
    53f7:	44 89 ee             	mov    %r13d,%esi           // esi=r13d=ppid
    53fa:	48 8d 3d 2c 0d 00 00 	lea    0xd2c(%rip),%rdi        # 612d <_IO_stdin_used@@Base+0x12d>  // "?"
    5401:	e8 ca fb ff ff       	callq  4fd0 <__sprintf_chk@plt+0x2860>  // fun_4fd0(comm, pid, uid)
    5406:	48 89 c5             	mov    %rax,%rbp
    5409:	e9 68 ff ff ff       	jmpq   5376 <__sprintf_chk@plt+0x2c06>*/

    /* reversed */
    /*540e:	48 8d 3d c1 0c 00 00 	lea    0xcc1(%rip),%rdi        # 60d6 <_IO_stdin_used@@Base+0xd6>
    5415:	e8 c6 d2 ff ff       	callq  26e0 <perror@plt>
    541a:	bf 01 00 00 00       	mov    $0x1,%edi
    541f:	e8 dc d2 ff ff       	callq  2700 <exit@plt>*/

    /*5424:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    542b:	00 00 00 00 
    542f:	90                   	nop
    5430:	f3 0f 1e fa          	endbr64 
    5434:	83 ff 06             	cmp    $0x6,%edi
    5437:	77 17                	ja     5450 <__sprintf_chk@plt+0x2ce0>
    5439:	89 ff                	mov    %edi,%edi
    543b:	48 8d 05 5e 37 00 00 	lea    0x375e(%rip),%rax        # 8ba0 <_IO_stdin_used@@Base+0x2ba0>    // gvar_8ba0
    5442:	48 8b 04 f8          	mov    (%rax,%rdi,8),%rax
    5446:	c3                   	retq   
    5447:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
    544e:	00 00 
    5450:	31 c0                	xor    %eax,%eax
    5452:	c3                   	retq   
    5453:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    545a:	00 00 00 00 
    545e:	66 90                	xchg   %ax,%ax*/

void fun_5460()
{
    /*5460:	f3 0f 1e fa          	endbr64 
    5464:	48 83 ec 08          	sub    $0x8,%rsp
    5468:	ba 05 00 00 00       	mov    $0x5,%edx
    546d:	48 8d 35 bb 0c 00 00 	lea    0xcbb(%rip),%rsi        # 612f <_IO_stdin_used@@Base+0x12f>  // "pstree (PSmisc) %s\n"
    5474:	31 ff                	xor    %edi,%edi
    5476:	e8 85 d0 ff ff       	callq  2500 <dcgettext@plt>
    547b:	48 8b 3d 9e 3f 00 00 	mov    0x3f9e(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    5482:	be 01 00 00 00       	mov    $0x1,%esi
    5487:	48 8d 0d b5 0c 00 00 	lea    0xcb5(%rip),%rcx        # 6143 <_IO_stdin_used@@Base+0x143>  // "UNKNOWN"
    548e:	48 89 c2             	mov    %rax,%rdx
    5491:	31 c0                	xor    %eax,%eax
    5493:	e8 88 d2 ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "UNKNOWN");

    /*5498:	ba 05 00 00 00       	mov    $0x5,%edx
    549d:	48 8d 35 9c 14 00 00 	lea    0x149c(%rip),%rsi        # 6940 <_IO_stdin_used@@Base+0x940>
    54a4:	31 ff                	xor    %edi,%edi
    54a6:	e8 55 d0 ff ff       	callq  2500 <dcgettext@plt>
    54ab:	48 8b 3d 6e 3f 00 00 	mov    0x3f6e(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    54b2:	be 01 00 00 00       	mov    $0x1,%esi
    54b7:	48 89 c2             	mov    %rax,%rdx
    54ba:	31 c0                	xor    %eax,%eax
    54bc:	e8 5f d2 ff ff       	callq  2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "Copyright (C) 1993-2019 Werner Almesberger and Craig Small\n\n");

    /*54c1:	ba 05 00 00 00       	mov    $0x5,%edx
    54c6:	48 8d 35 b3 14 00 00 	lea    0x14b3(%rip),%rsi        # 6980 <_IO_stdin_used@@Base+0x980>
    54cd:	31 ff                	xor    %edi,%edi
    54cf:	e8 2c d0 ff ff       	callq  2500 <dcgettext@plt>
    54d4:	48 8b 3d 45 3f 00 00 	mov    0x3f45(%rip),%rdi        # 9420 <stderr@@GLIBC_2.2.5>
    54db:	be 01 00 00 00       	mov    $0x1,%esi
    54e0:	48 83 c4 08          	add    $0x8,%rsp
    54e4:	48 89 c2             	mov    %rax,%rdx
    54e7:	31 c0                	xor    %eax,%eax
    54e9:	e9 32 d2 ff ff       	jmpq   2720 <__fprintf_chk@plt>*/
        fprintf(stderr, "%s", "PSmisc comes with ABSOLUTELY NO WARRANTY.\nThis is free software, and you are welcome to redistribute it under\nthe terms of the GNU General Public License.\nFor more information about these matters, see the files named COPYING.\n");

    /*54ee:	66 90                	xchg   %ax,%ax
    54f0:	f3 0f 1e fa          	endbr64 
    54f4:	41 57                	push   %r15
    54f6:	4c 8d 3d 93 36 00 00 	lea    0x3693(%rip),%r15        # 8b90 <_IO_stdin_used@@Base+0x2b90>
    54fd:	41 56                	push   %r14
    54ff:	49 89 d6             	mov    %rdx,%r14
    5502:	41 55                	push   %r13
    5504:	49 89 f5             	mov    %rsi,%r13
    5507:	41 54                	push   %r12
    5509:	41 89 fc             	mov    %edi,%r12d
    550c:	55                   	push   %rbp
    550d:	48 8d 2d 84 36 00 00 	lea    0x3684(%rip),%rbp        # 8b98 <_IO_stdin_used@@Base+0x2b98>
    5514:	53                   	push   %rbx
    5515:	4c 29 fd             	sub    %r15,%rbp
    5518:	48 83 ec 08          	sub    $0x8,%rsp
    551c:	e8 df ca ff ff       	callq  2000 <__cxa_finalize@plt-0x3d0>
    5521:	48 c1 fd 03          	sar    $0x3,%rbp
    5525:	74 1f                	je     5546 <__sprintf_chk@plt+0x2dd6>
    5527:	31 db                	xor    %ebx,%ebx
    5529:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
    5530:	4c 89 f2             	mov    %r14,%rdx
    5533:	4c 89 ee             	mov    %r13,%rsi
    5536:	44 89 e7             	mov    %r12d,%edi
    5539:	41 ff 14 df          	callq  *(%r15,%rbx,8)
    553d:	48 83 c3 01          	add    $0x1,%rbx
    5541:	48 39 dd             	cmp    %rbx,%rbp
    5544:	75 ea                	jne    5530 <__sprintf_chk@plt+0x2dc0>
    5546:	48 83 c4 08          	add    $0x8,%rsp
    554a:	5b                   	pop    %rbx
    554b:	5d                   	pop    %rbp
    554c:	41 5c                	pop    %r12
    554e:	41 5d                	pop    %r13
    5550:	41 5e                	pop    %r14
    5552:	41 5f                	pop    %r15
    5554:	c3                   	retq   
    5555:	66 66 2e 0f 1f 84 00 	data16 nopw %cs:0x0(%rax,%rax,1)
    555c:	00 00 00 00 
    5560:	f3 0f 1e fa          	endbr64 
    5564:	c3                   	retq   */
}

int get_ws_col()
{
    char *ptr_strtol;
    struct winsize p_0xa8 = {0};
    int col = 0;

    char *p_getenv = getenv("COLUMNS");

    if ((p_getenv != NULL) && (*p_getenv != 0)) {
        col = strtol(p_getenv, &ptr_strtol, 0);
        printf("col = %d\n", col);

        if ( (!*ptr_strtol) && (col > 0) && (col < 0x7ffffffd)) {
            return col;
        }
	}

    if (ioctl(1, 0x5413, &p_0xa8) >= 0) {
        if (p_0xa8.ws_col != 0) {
            return p_0xa8.ws_col;
        }
    }

    return 0x84;
}
